Add private workspaces and native TigerApps cards

[DIodide]

Summary

• Add private NetID-scoped workspaces with persistent chat membership, saved courses, context notes, and server-side context injection.
• Render PrincetonCourses-style cards with real metadata and save-to-workspace controls.
• Show only explicitly selected TigerJunction sections in the native timetable, with an empty state when none are picked.
• Preserve the newly merged TigerInbox connector.

Validation

• 40 PI tests passing; production build passing.
• Desktop and mobile browser checks for workspace creation, edits, chat assignment, saving courses, persistence, and overflow.
• Verified anonymous workspace requests return 401 and cross-origin edits return 403.

Companion engine PR exposes section selection metadata; merge/deploy it before this change.