feat: implement workspace management and member invitations

- Added tenant API for managing workspaces, including listing, creating, and inviting members.
- Introduced new models for organizations, workspaces, and workspace memberships in the backend.
- Created frontend components for workspace administration, allowing users to manage workspaces and invite members.
- Updated document listing to support workspace-specific filtering.
- Implemented account settings page for user profile management and password changes.
- Added end-to-end tests for workspace administration and dashboard functionalities.

README.md

@@ -194,6 +194,39 @@ Validation completed:
 - FastAPI application import and route registration
 - `cd frontend && npm run test:e2e` (3 tests skipped without test credentials)
 
+#### Phase 9 — Identity and account foundation (in progress)
+
+- Added a real profile/settings surface at `/profile` and `/settings`.
+- Added profile updates for name, occupation, and phone.
+- Added authenticated password changes with current-password verification.
+- Added explicit sign-out behavior that clears the local session.
+- Added a signed Google OAuth authorization-state flow:
+  `/api/v1/auth/google/login` and `/api/v1/auth/google/callback`.
+- Added Google account provisioning by verified email and automatic login
+  session creation.
+- Added the frontend OAuth callback route and connected the login form to the
+  backend Google flow.
+- Added configuration for `FRONTEND_URL`, `GOOGLE_CLIENT_ID`,
+  `GOOGLE_CLIENT_SECRET`, and `GOOGLE_REDIRECT_URI`.
+- Google sign-in remains explicitly disabled until provider credentials are
+  configured; the API returns a clear configuration error instead of a
+  success-shaped fallback.
+
+Validation completed:
+
+- `cd frontend && npm run build`
+- `python -m compileall backend\app`
+- FastAPI application import and route registration
+- Backend requirements installation including `httpx`
+
+Next identity work:
+
+- Add refresh-token rotation and server-side session/device management.
+- Add email verification, recovery email delivery, and account deletion.
+- Add provider identity metadata and organization/workspace membership.
+- Add security activity, login history, and configurable notification/privacy
+  settings.
+
 ### Dashboard onboarding
 
 - Returning users see recent documents ordered by their last visited activity.
@@ -216,3 +249,46 @@ The frontend build is verified with:
 cd frontend
 npm run build
 ```
+
+#### Phase 10 — Organizations, workspaces, members, and tenant administration (in progress)
+
+- Added SQLAlchemy tenant tables for organizations, workspaces, workspace
+  memberships, and expiring single-use invitations.
+- Added explicit tenant roles: owner, admin, member, and viewer.
+- Added authenticated workspace listing and workspace creation.
+- Added workspace member listing, role changes, invitation creation, and
+  invitation acceptance with email matching and expiry enforcement.
+- Added invitation resend and revoke endpoints.
+- Added workspace ownership transfer with organization-owner synchronization.
+- Added tenant audit events for workspace creation, invitation creation,
+  invitation revocation, and ownership transfer.
+- Added workspace-scoped MongoDB document metadata and dashboard filtering.
+- Existing owner-owned spaces and pages are backfilled into the selected
+  workspace on first workspace load without changing their content or sharing.
+- New document creation rejects workspace IDs the authenticated user cannot
+  access.
+- Added a workspace administration page at `/settings/workspaces` for
+  creating organizations/workspaces, inviting members, and managing roles.
+- Kept existing personal spaces and document-level sharing compatible while the
+  next tenant step associates MongoDB spaces with a selected workspace.
+- Removed the redundant FAQ/help and settings icons from the dashboard header;
+  profile remains the single account entry point.
+- Removed the unused Customize sidebar action and its controls.
+- Updated Invite Fellow to create a workspace invitation and open a prefilled
+  email containing the invitation link.
+
+Validation completed:
+
+- `python -m compileall backend\app`
+- FastAPI import and tenant route registration (`45` routes)
+- `cd frontend && npm run build`
+- `git diff --check`
+- `cd frontend && npm run test:e2e` (Phase 10 tenant shell coverage; requires
+  `E2E_USERNAME` and `E2E_PASSWORD`)
+
+Next tenant work:
+
+- Add workspace context to spaces and page creation.
+- Add invitation and audit history views to the administration page.
+- Add organization-level security settings.
+- Add authenticated browser coverage for workspace creation and role denial.