- Added a dedicated ai:workspace:use permission, separating AI Workspace access from Gateway Inference access. - Preserved existing AI Workspace grants during migration and enabled access by default for built-in Viewer-and-higher groups. - Hid AI Workspace entry points and redirected unavailable Workspace routes for users without the required permission. - Fixed Windows OAuth login in @wiolett/gateway-inference by preventing authorization URLs from being truncated at the first &. - Added an interactive login choice between browser OAuth and an existing masked gwi_ inference token, with token validation before storage.