fix(handlers): add IsSaaS() and DefaultTier() methods to WorkspaceHandler

PR #1051 inherited the IsSaaS()/DefaultTier() calls from PR #1047
(SaaS tier hard-gate) but the method definitions were missing, causing
a compile failure:

    undefined: WorkspaceHandler.IsSaaS
    undefined: WorkspaceHandler.DefaultTier

Added:
- IsSaaS() bool — returns h.cpProv != nil. True when the platform
  has a control-plane provisioner (SaaS tenant). False for self-hosted.
- DefaultTier() int — returns 3. Self-hosted default. SaaS workspaces
  always get Tier 4 via the IsSaaS() gate in Create.

Resolves the compile blocker flagged by app-fe and hongming-pc2 on PR #1051.

Refs: PR #1047 (IsSaaS tier gate), PR #1051 (compile fix)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

workspace-server/internal/handlers/workspace.go

@@ -127,6 +127,26 @@ func (h *WorkspaceHandler) SetCPProvisioner(cp provisioner.CPProvisionerAPI) {
 	h.cpProv = cp
 }
 
+// IsSaaS returns true when the platform has a control-plane provisioner,
+// i.e., it's running in SaaS mode. In SaaS, every workspace gets its own
+// EC2 instance, so Tier 4 is the only meaningful runtime boundary — this
+// is why the Create handler hard-gates SaaS workspaces to Tier 4 regardless
+// of what the client or template requests. Returns false for self-hosted
+// deployments (no cpProv wired).
+func (h *WorkspaceHandler) IsSaaS() bool {
+	return h.cpProv != nil
+}
+
+// DefaultTier returns the default tier for self-hosted workspaces.
+// T3 (privileged) is the baseline for self-hosted: full read-write
+// workspace mount + Docker daemon access, suitable for most templates.
+// T1 (sandboxed) and T2 (standard) are explicit opt-ins for low-trust
+// local agents. SaaS workspaces always get Tier 4 via the IsSaaS() gate
+// in Create regardless of the template or client request.
+func (h *WorkspaceHandler) DefaultTier() int {
+	return 3
+}
+
 // SetEnvMutators wires a provisionhook.Registry into the handler. Plugins
 // living in separate repos register on the same Registry instance during
 // boot (see cmd/server/main.go) and main.go calls this setter once before