feat: add server error logging and tighten workspace isolation

apps/api/src/routes/analytics.ts

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
 import { db, tasks, habits, habitCompletions, projects } from "@project-e/db";
 import { and, eq, gte, inArray, isNull, or } from "drizzle-orm";
-import { requireAuth, resolveActiveDomain, AuthError } from "../middleware/auth";
+import { requireAuth, resolveActiveDomain, requireWorkspaceAccess, AuthError } from "../middleware/auth";
 
 export const analyticsRoutes = new Hono();
 
@@ -17,6 +17,8 @@ analyticsRoutes.get("/productivity", async (c) => {
       domainId = active.id;
     }
 
+    await requireWorkspaceAccess(c, domainId);
+
     const startDate = new Date();
     startDate.setDate(startDate.getDate() - range);
 
@@ -58,6 +60,8 @@ analyticsRoutes.get("/habits", async (c) => {
       domainId = active.id;
     }
 
+    await requireWorkspaceAccess(c, domainId);
+
     const startDate = new Date();
     startDate.setDate(startDate.getDate() - range);
 
@@ -113,6 +117,8 @@ analyticsRoutes.get("/projects", async (c) => {
       domainId = active.id;
     }
 
+    await requireWorkspaceAccess(c, domainId);
+
     const allProjects = await db.select()
       .from(projects)
       .where(and(eq(projects.domainId, domainId), isNull(projects.deletedAt)));
@@ -178,6 +184,8 @@ analyticsRoutes.get("/daily", async (c) => {
       domainId = active.id;
     }
 
+    await requireWorkspaceAccess(c, domainId);
+
     // Buckets cover the last `range` days ending today, matching the frontend's expectation.
     const firstDay = new Date();
     firstDay.setDate(firstDay.getDate() - (range - 1));