feat: scope workspace routes by organization slug

.trellis/spec/frontend/components.md

@@ -216,6 +216,17 @@ surface.
   implemented, show an honest not-connected state instead of fake provider accounts.
 - The sidebar nav selected state belongs in a small client component using `usePathname()`;
   keep the rest of `AppShell` server-rendered.
+- Authenticated workspace links should preserve the active organization slug by using
+  `modules/shared/lib/workspace-routing.ts`. Sidebar links, breadcrumbs, permission
+  redirects, table search/pagination paths, login redirects, and organization switch
+  redirects should call `getWorkspaceHref(activeSlug, workspacePath)` instead of hard-coding
+  `/app/...` paths.
+- The legacy unscoped `/app/...` paths remain valid fallback paths for accounts without an
+  active organization. When a session has an active organization, redirect into
+  `/app/{organizationSlug}/...` so operators can see which workspace they are using.
+- Top-level workspace route names such as `dashboard`, `settings`, `elders`, and `beds` are
+  reserved path segments, not tenant identifiers. Keep the frontend reserved list in
+  `workspace-routing.ts` aligned with backend organization slug validation.
 
 ### Business Form Defaults Contract