feat(api): CUST-WP-0018 — API hardening & code quality

T01: Fix datetime.utcnow() → datetime.now(tz=timezone.utc) in MCP server
T02: Wrap _get/_post/_patch/_delete with try/except; return error dicts
T03: Log warnings when write_log skips missing project path
T04: Add priority + due_date_before filters to GET /tasks/
T05: Add owner + slug filters to GET /workstreams/
T06: Add offset param to GET /progress/ for proper pagination
T07: Low-severity bundle:
  - CORS origins from CORS_ORIGINS env var (TD-017)
  - seed.py upsert domains+topics on re-run (TD-011)
  - normalise filter bar CSS → filter-text-input everywhere (TD-016)
  - add 30.5 avg-days-per-month comment in decisions.md (TD-019)
  - TD-009, TD-018 already resolved by existing code

Closes CUST-WP-0018.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/routers/workstreams.py

@@ -17,6 +17,8 @@ async def list_workstreams(
     repo_id: uuid.UUID | None = None,
     repo_goal_id: uuid.UUID | None = None,
     status: WorkstreamStatus | None = None,
+    owner: str | None = None,
+    slug: str | None = None,
     session: AsyncSession = Depends(get_session),
 ) -> list[Workstream]:
     q = select(Workstream)
@@ -28,6 +30,10 @@ async def list_workstreams(
         q = q.where(Workstream.repo_goal_id == repo_goal_id)
     if status:
         q = q.where(Workstream.status == status)
+    if owner:
+        q = q.where(Workstream.owner == owner)
+    if slug:
+        q = q.where(Workstream.slug == slug)
     q = q.order_by(Workstream.updated_at.desc())
     result = await session.execute(q)
     return list(result.scalars().all())