feat: implement identity management and workspace context

- Introduced identity management features, including user and workspace context handling.
- Added `IdentityService` for orchestrating user identity and workspace management.
- Created domain entities and repository protocols for `User` and `Workspace`.
- Implemented SQLAlchemy repositories for user and workspace persistence.
- Enhanced gRPC interceptors to propagate identity context across RPC calls.
- Updated application services to integrate identity management into existing workflows.

All quality checks pass.

AGENTS.md

@@ -10,14 +10,15 @@
 ## Quick Orientation (Start Here)
 - Backend entry point: `python -m noteflow.grpc.server` (service implementation in `src/noteflow/grpc/service.py`).
 - Tauri/React client: `cd client && npm run dev` (web), or `npm run tauri dev` (desktop).
-- Tauri IPC bridge: `client/src/lib/tauri.ts` (TS) <-> `client/src-tauri/src/commands/` (Rust).
+- Tauri IPC bridge: `client/src/api/tauri-adapter.ts` (TS) <-> `client/src-tauri/src/commands/` (Rust).
 - Protobuf contract and generated stubs live in `src/noteflow/grpc/proto/`.
 
 ## Project Structure & Module Organization
 - `src/noteflow/domain/` defines entities, value objects, and port protocols; keep this layer pure and testable.
-- `src/noteflow/application/` hosts use-case services that orchestrate domain + infrastructure.
-- `src/noteflow/infrastructure/` provides concrete adapters (audio, ASR, persistence, security, summarization, triggers).
-- `src/noteflow/grpc/` contains the server, client wrapper, mixins, and proto conversions.
+- `src/noteflow/application/` hosts use-case services (Meeting, Recovery, Export, Summarization, Trigger, Webhook, Calendar, Retention, NER).
+- `src/noteflow/infrastructure/` provides concrete adapters (audio, ASR, persistence, security, summarization, triggers, calendar, ner, observability, webhooks, converters).
+- `src/noteflow/grpc/` contains the server, client wrapper, modular mixins (streaming/, diarization/ as packages), and proto conversions.
+- `src/noteflow/cli/` provides CLI tools for retention management and model commands.
 - `client/` is the Tauri/Vite React client; UI in `client/src/`, Rust shell in `client/src-tauri/`, e2e tests in `client/e2e/`.
 
 ## Backend Architecture & Data Flow
@@ -28,9 +29,12 @@
 - Encryption, key storage, and secure asset handling live in `src/noteflow/infrastructure/security/`.
 
 ## Client Architecture (Tauri + React)
-- React components are in `client/src/components/`, state in `client/src/store/`, and shared UI types in `client/src/types/`.
-- Tauri command calls are centralized in `client/src/lib/tauri.ts`; the Rust command handlers live in `client/src-tauri/src/commands/`.
+- React components are in `client/src/components/`, custom hooks in `client/src/hooks/`, and shared types in `client/src/types/`.
+- API layer lives in `client/src/api/` with adapters (`tauri-adapter.ts`, `mock-adapter.ts`, `cached-adapter.ts`) and connection management.
+- React contexts are in `client/src/contexts/` (e.g., `connection-context.tsx` for gRPC state).
+- Tauri command calls are in `client/src/api/tauri-adapter.ts`; Rust command handlers live in `client/src-tauri/src/commands/`.
 - Rust app entry points are `client/src-tauri/src/main.rs` and `client/src-tauri/src/lib.rs`; shared state lives in `client/src-tauri/src/state/`.
+- Rust gRPC client is organized under `client/src-tauri/src/grpc/` with `client/` and `types/` subdirectories.
 - Client tests are colocated with UI code (Vitest) and end-to-end tests live in `client/e2e/` (Playwright).
 
 ## Contracts & Sync Points (High Risk of Breakage)
@@ -38,7 +42,7 @@
 - Python gRPC stubs are checked in under `src/noteflow/grpc/proto/`; regenerate them when the proto changes.
 - Rust/Tauri gRPC types are generated at build time by `client/src-tauri/build.rs`; keep Rust types aligned with proto changes.
 - Frontend enums/DTOs in `client/src/types/` mirror proto enums and backend domain types; update together to avoid runtime mismatches.
-- When adding or renaming RPCs, update server mixins, `src/noteflow/grpc/client.py`, and Tauri command wrappers.
+- When adding or renaming RPCs, update server mixins, `src/noteflow/grpc/client.py`, Tauri command wrappers, and `client/src/api/tauri-adapter.ts`.
 
 ## Common Pitfalls & Change Checklist
 
@@ -48,7 +52,7 @@
 - Update gRPC server mixins in `src/noteflow/grpc/_mixins/` and service wiring in `src/noteflow/grpc/service.py`.
 - Update the Python client wrapper in `src/noteflow/grpc/client.py`.
 - Update Tauri/Rust command handlers in `client/src-tauri/src/commands/` and any Rust gRPC types.
-- Update TypeScript calls in `client/src/lib/tauri.ts` and DTOs/enums in `client/src/types/`.
+- Update TypeScript adapters in `client/src/api/tauri-adapter.ts` and DTOs/enums in `client/src/types/` and `client/src/api/types/`.
 - Add or adjust tests in both backend and client to cover payload changes.
 
 ### Database schema & migrations
@@ -58,9 +62,9 @@
 - Keep export/summarization converters in `src/noteflow/infrastructure/converters/` aligned with schema changes.
 
 ### Client sync points (Rust + TS)
-- Tauri command signatures in `client/src-tauri/src/commands/` must match TypeScript calls in `client/src/lib/tauri.ts`.
+- Tauri command signatures in `client/src-tauri/src/commands/` must match TypeScript calls in `client/src/api/tauri-adapter.ts`.
 - Rust gRPC types are generated by `client/src-tauri/build.rs`; verify proto paths when moving files.
-- Frontend enums in `client/src/types/` mirror proto enums; update both sides together.
+- Frontend enums in `client/src/types/` and `client/src/api/types/` mirror proto enums; update both sides together.
 
 ## Build, Test, and Development Commands
 - Backend setup/run: `python -m pip install -e ".[dev]"`, `python -m noteflow.grpc.server`.