refactor(handlers): widen WorkspaceHandler.provisioner to LocalProvisionerAPI interface (#2369)

[HongmingWang-Rabbit]

Closes #2369.

Why

`WorkspaceHandler` typed its CP-side via `provisioner.CPProvisionerAPI` (interface, mockable) but its Docker-side via `*provisioner.Provisioner` (concrete, harder to mock). This PR closes that asymmetry.

What

• New `provisioner.LocalProvisionerAPI` interface — the 7 methods handlers actually call: `Start`, `Stop`, `IsRunning`, `ExecRead`, `RemoveVolume`, `VolumeHasFile`, `WriteAuthTokenToVolume`. Compile-time assertion that `*Provisioner` satisfies it. Mirror of `cp_provisioner.go`'s `CPProvisionerAPI` block.
• `WorkspaceHandler.provisioner` and `TeamHandler.provisioner` re-typed to the interface. Constructor parameter type is unchanged — the assignment widens — so 200+ callers of `NewWorkspaceHandler`/`NewTeamHandler` are unaffected.
• Constructors gain an `if p != nil { h.provisioner = p }` guard. Without this, passing `nil` (the test fixture pattern) yields a typed-nil interface where `h.provisioner != nil` evaluates as true — the classic Go "why is my nil error not nil" trap. Inline doc-comment cites the Go FAQ.
• Hardened the 5 `Provisioner` methods that lacked nil-receiver guards (`Start`, `ExecRead`, `WriteAuthTokenToVolume`, `RemoveVolume`, `VolumeHasFile`). Each now returns `ErrNoBackend` on nil receiver instead of panicking. Symmetric with `Stop`/`IsRunning` (already hardened in [testing] Harden Provisioner.{Stop,IsRunning} against nil Docker/HTTP client (backends.md drift-risk #6) #1813). Defensive cleanup: even if a future caller bypasses the constructor's nil-elision, behavior degrades cleanly instead of panic.
• Extended `TestZeroValuedBackends_NoPanic` with 5 new nil-receiver subtests for the newly-hardened methods. Defense-in-depth.

Drift gate

The compile-time assertion `var _ LocalProvisionerAPI = (*Provisioner)(nil)` blocks any future method-signature drift on `*Provisioner` that would silently break handlers — same protection `CPProvisionerAPI` has had since #1814.

Verification

• `go build ./...` — clean
• `go test ./...` — all 19 packages green (~1500 tests)
• `go test ./internal/provisioner/ -run TestZeroValuedBackends_NoPanic -v` — 11 subtests pass (was 6 before; +5 for the new nil-receiver paths)
• Hand-verified: `NewWorkspaceHandler(b, nil, ...)` produces a handler where `h.provisioner == nil` evaluates true (the typed-nil trap is sidestepped by constructor)

Test plan

• Existing 200+ tests calling `NewWorkspaceHandler(..., nil, ...)` still pass without modification
• New nil-receiver subtests pass for all 5 newly-hardened methods
• Compile-time assertion catches drift if any method signature on `*Provisioner` changes
• Build clean across the full server suite

🤖 Generated with Claude Code