feat: workspace routing, GlobalSearch, and shell refinements

- Add workspace-aware startup routing (openDefaultWorkspaceRoute)
- Add GlobalSearch component and workspace-empty state
- Refactor Sidebar, StatusBar, WorkspaceTree, VaultSelection
- Update PluginCard/PluginManager UI
- Extend e2e coverage (ux-p0, ux-followup, helpers)
- Add ListWorkspaces/SetCurrentWorkspace backend bindings

internal/api/app.go

@@ -1444,9 +1444,30 @@ func decodeSecretRecord(raw map[string]interface{}) (coresecrets.SecretRecord, e
 	if err := json.Unmarshal(data, &record); err != nil {
 		return coresecrets.SecretRecord{}, err
 	}
+	if strings.TrimSpace(record.ID) == "" {
+		record.ID = generatedSecretID(record.Title)
+	}
 	return record, nil
 }
 
+func generatedSecretID(title string) string {
+	base := strings.ToLower(strings.TrimSpace(title))
+	base = strings.Map(func(r rune) rune {
+		if r >= 'a' && r <= 'z' || r >= '0' && r <= '9' || r == '.' || r == '_' || r == '-' {
+			return r
+		}
+		if r == ' ' || r == '\t' || r == '\n' || r == '\r' {
+			return '-'
+		}
+		return -1
+	}, base)
+	base = strings.Trim(base, ".-_")
+	if base == "" {
+		base = "secret"
+	}
+	return fmt.Sprintf("%s-%d", base, time.Now().UnixNano())
+}
+
 func secretRecordMap(record coresecrets.SecretRecord, includeValue bool) map[string]interface{} {
 	result := map[string]interface{}{
 		"id":        record.ID,