Auto-mint default MCP token on workspace creation

- ensureWorkspaceForUser() now calls mintWorkspaceApiKey('default') on first workspace creation
- Legacy workspaces without a default key get one minted on first request
- GET /api/workspaces/[slug]/keys/default reveals (or mints) the default token for session users
- Chat panel fetches the token automatically on mount, caches it in localStorage
- No manual setup needed — tool calling works immediately on first sign-in

Made-with: Cursor

lib/workspaces.ts

@@ -25,6 +25,7 @@ import {
   COOLIFY_DEFAULT_SERVER_UUID,
   COOLIFY_DEFAULT_DESTINATION_UUID,
 } from '@/lib/coolify';
+import { mintWorkspaceApiKey } from '@/lib/auth/workspace-auth';
 import {
   createOrg,
   getOrg,
@@ -178,6 +179,20 @@ export async function ensureWorkspaceForUser(opts: {
     [workspace.id, opts.userId]
   );
 
+  // Auto-mint a default API key so the chat panel and Cursor MCP
+  // integration work without any manual setup step.
+  try {
+    await mintWorkspaceApiKey({
+      workspaceId: workspace.id,
+      name: 'default',
+      createdBy: opts.userId,
+      scopes: ['workspace:*'],
+    });
+  } catch (err) {
+    // Non-fatal — user can mint manually in Settings if this fails.
+    console.error('[workspaces] auto-mint default key failed', workspace.slug, err);
+  }
+
   return workspace;
 }