Workspace housekeeping

POST   /workspaces/{id}/activate
POST   /workspaces/{id}/logo
DELETE /workspaces/{id}/logo
DELETE /workspaces/{id}/invites/{inviteId}

activate switches which workspace is "current" for session-based (dashboard) use and returns { "ok": true }. API-key callers rarely need it: pass X-Workspace-Id on the request instead, which scopes that one call without changing any stored state.

logo takes a multipart/form-data upload with the image in a field named file (PNG, JPEG, WebP or SVG, up to 2 MB) and returns { "logoUrl": "…" }; DELETE removes it and returns { "ok": true }. Both need owner or admin. DELETE /workspaces/{id}/invites/{inviteId} (owner or admin) revokes an invite and returns { "ok": true }. activate works for any member and uses no body.