feat(console): add workspace block support action

[heimoshuiyu]

Summary

• Adds Workspace.block to packages/console/core/src/workspace.ts, mirroring the existing Workspace.unblock (sets is_blocked = true, throws if the workspace does not exist)
• Adds POST /api/support/actions/block-workspace, mirroring unblock-workspace.ts (bearer auth via SUPPORT_API_KEY, body { "workspaceID": "wrk_..." })

Motivation

The console already supports unblocking a workspace through the support API, and zen/util/handler.ts enforces is_blocked on every Zen API request, but there is no code path that sets is_blocked = true — operators currently have to flip the flag by hand in the database. This adds the missing inverse operation so block/unblock are both first-class support actions.

Usage

POST /api/support/actions/block-workspace
Authorization: Bearer <SUPPORT_API_KEY>

{ "workspaceID": "wrk_xxx" }

• 200 — {"success":true,"message":"Workspace blocked"}
• 400 — invalid body or workspace not found
• 401 — missing/incorrect support key

Blocking is idempotent: an already-blocked workspace still returns 200. Since MySQL reports 0 affected rows for no-op updates, Workspace.block falls back to a select to distinguish "already blocked" (success) from "workspace not found" (400).

Note that enforcement happens at the Zen API auth boundary — in-flight streaming responses continue until they finish; only new requests are rejected.

Testing

• bun run typecheck in packages/console/core and packages/console/app: no new errors from these files (both packages have pre-existing implicit-any noise from drizzle type inference in this environment)
• No tests added — existing support actions (unblock-workspace, delete-account, reset-quota) have no test coverage either

[github-actions]

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

• PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

[github-actions]

This pull request has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window.

Feel free to open a new pull request that follows our guidelines.