List the caller's workspaces (individual first, then orgs, then teams)

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.