feat(app): wire workspace module + integration test for ws closed loop

internal/workspace/workspace_service_test.go

@@ -220,6 +220,55 @@ func TestWorkspaceService_Create_HappyPath(t *testing.T) {
 	require.True(t, ok)
 }
 
+func TestWorkspaceService_Create_NilScheduler_NoPanic(t *testing.T) {
+	// app 装配有"先建 service（scheduler=nil）→ 再用 service 构 cloneRunner → SetScheduler 回填"的环依赖。
+	// Create 必须在 scheduler==nil 时安全跳过 Schedule，否则首个 workspace 会 panic。
+	t.Parallel()
+	pa := &fakePA{pid: uuid.New(), canRead: true, canWrite: true}
+	svc, repo := newSvc(t, pa, nil, &fakeGit{})
+	caller := Caller{UserID: uuid.New()}
+	ws, err := svc.Create(context.Background(), caller, "p", CreateWorkspaceInput{
+		Slug: "ws1", Name: "W1", GitRemoteURL: "https://x", DefaultBranch: "main",
+		Credential: UpsertCredentialInput{Kind: CredKindNone},
+	})
+	require.NoError(t, err)
+	require.Equal(t, SyncStatusCloning, ws.SyncStatus)
+	_, ok := repo.creds[ws.ID]
+	require.True(t, ok)
+}
+
+func TestWorkspaceService_SetScheduler_BackfillSchedules(t *testing.T) {
+	// SetScheduler 把 nil scheduler 替换为真正实现，下一次 Create 应触发 Schedule。
+	t.Parallel()
+	pa := &fakePA{pid: uuid.New(), canRead: true, canWrite: true}
+	svc, _ := newSvc(t, pa, nil, &fakeGit{})
+	sched := &fakeSched{}
+	// SchedulerSetter 接口契约：app.go 在构建 CloneRunner 后回填。
+	var setter SchedulerSetter = svc
+	setter.SetScheduler(sched)
+	caller := Caller{UserID: uuid.New()}
+	ws, err := svc.Create(context.Background(), caller, "p", CreateWorkspaceInput{
+		Slug: "ws2", Name: "W2", GitRemoteURL: "https://x", DefaultBranch: "main",
+		Credential: UpsertCredentialInput{Kind: CredKindNone},
+	})
+	require.NoError(t, err)
+	require.Len(t, sched.called, 1)
+	require.Equal(t, ws.ID, sched.called[0])
+}
+
+func TestWorkspaceService_LoadDecryptedCredential_PassThrough(t *testing.T) {
+	// CredentialAccessor 接口暴露内部 loadDecryptedCredential，CloneRunner / GitOpsService 复用。
+	t.Parallel()
+	pa := &fakePA{pid: uuid.New(), canRead: true, canWrite: true}
+	svc, _ := newSvc(t, pa, nil, &fakeGit{})
+	var acc CredentialAccessor = svc
+	cred, err := acc.LoadDecryptedCredential(context.Background(), uuid.New())
+	require.NoError(t, err)
+	require.NotNil(t, cred)
+	// 没有凭据行 → 返回 git.CredentialNone（loadDecryptedCredential 的兜底）。
+	require.Equal(t, git.CredentialNone, cred.Kind)
+}
+
 func TestWorkspaceService_Create_BadSlug(t *testing.T) {
 	t.Parallel()
 	pa := &fakePA{pid: uuid.New(), canWrite: true, canRead: true}