feat: add helpers and improve workspace auth flows

docs/GUIDE.md

@@ -1020,8 +1020,11 @@ page Users {
 
 ## 27. Optional packages
 
-Dependency‑free (Bun/WebCrypto). Import only what you need.
+Convenience helpers and dependency-free feature packages. Import only what you need.
 
+- **`@wrnexus/helpers`** — context helpers including `getOriginalRequestUrl`,
+  `getOriginalRequestOrigin`, `getOriginalRequestPath`, `getOriginalRequestMethod`, and the safe
+  forward-auth `redirectToLogin(ctx, "/login", { allowedHosts })` response helper.
 - **`@wrnexus/jwt`** — `signJwt(payload, secret, { expiresIn?, now? })`, `verifyJwt(token, secret)`
   (throws `JwtError`), `jwtAuth({ secret, getToken?, required? })` middleware.
 - **`@wrnexus/oauth`** — PKCE OAuth 2.0. Presets `google/github/discord(creds)` + `defineProvider`.
@@ -1226,6 +1229,7 @@ wrnexus dev [app-dir] [--port=3000] [--profile=<name>]   Dev server (live reload
 wrnexus build [app-dir] [--profile=<name>]               Production bundle → dist/  (production profile by default)
 wrnexus create <app-name>                                Scaffold a new app
 wrnexus workspace <name>                                 Scaffold a monorepo (apps/* + shared packages/*)
+wrnexus workspace add <name> [--domain=name.localhost]  Add an app to the current workspace
 wrnexus gateway [--port=3000] [--prod]                   Serve every workspace app behind one port, routed by domain
 wrnexus generate <type> <name>   (alias: g)              Scaffold: page | component | api | schema
 wrnexus generate routes                                  Regenerate app/routes.gen.ts
@@ -1353,6 +1357,7 @@ directive to `false`/`null` to remove it.
 - `@wrnexus/dev-server` — `startServer`, `startGateway` (multi-app host router), prod handler.
 - `@wrnexus/cli` — the `wrnexus` binary; subpath `/workspace` (`WorkspaceConfig`, `startGateway` wiring).
 - `@wrnexus/validation` — `v`, `parseBody`, `parseEnv`, `invalid`, `renderSchemasScript`.
+- `@wrnexus/helpers` — original gateway URL/path/method helpers and `redirectToLogin`.
 - `@wrnexus/ui` — `uiComponentsDir`, `uiCssPath`, `uiCss`, `uiComponentNames`.
 - `@wrnexus/i18n` — `loadLocales`, `resolveI18n`, `makeT`, `resolveLang`, `translateHtml`,
   `formatNumber`, `formatCurrency`, `formatDate`, `formatRelativeTime`, `plural`.

docs/PUBLISHING.md

@@ -1,6 +1,6 @@
 # Publishing WrNexus to npm
 
-All 25 `@wrnexus/*` packages are built and published to the **public npm registry**
+All 26 `@wrnexus/*` packages are built and published to the **public npm registry**
 (`registry.npmjs.org`), then installed on any machine with **Bun**.
 
 ## Prerequisites