- publishCarousel now caps images at the platform max so the API/MCP paths
can't bypass the 10-image limit the UI enforces
- waitForProcessing throws on timeout instead of posting against an asset
still being processed; poll attempts/interval extracted to overridable
protected methods for testability
- scope EnsureHasWorkspace to connect entry points + disconnect only;
session-driven OAuth callbacks/selects stay ungated so a missing current
workspace can't HTML-redirect the popup instead of closing it cleanly
EnsureAccountReady bundled a subscription gate (redirects to onboarding,
SaaS only) with a workspace gate (redirects to workspace creation). The
connect routes can't sit behind it because connecting/disconnecting
happens during onboarding, before a subscription exists.
Split the workspace gate into a standalone EnsureHasWorkspace middleware:
- EnsureAccountReady is now subscription-only.
- EnsureHasWorkspace redirects to workspace creation when there is no
current workspace, in both SaaS and self-hosted modes.
- The social connect group gains EnsureHasWorkspace; the main app group
gains it alongside EnsureAccountReady (listed after it, so the
subscription gate still runs first — no custom middleware priority).
- The repeated `if (! $workspace) redirect()` guard is removed from the
connect/store/authorize/disconnect/index/toggle handlers, and their
return types are tightened (no more dangling RedirectResponse).
LinkedIn connect's no-workspace path changes from a popup callback to the
same redirect as the other platforms.
