fix: prevent base64 misinterpretation of numeric workspace IDs

Numeric string IDs like "164" are valid base64 that decodes to garbage
(Hebrew character "׮"), causing silent workspace lookup failures.
Skip base64 encoding/decoding for numeric IDs and only use it for
legacy path-based workspace identifiers.

packages/app/src/utils/host-routes.ts

@@ -163,7 +163,13 @@ export function encodeWorkspaceIdForPathSegment(workspaceId: string): string {
   if (!normalized) {
     return "";
   }
-  return toBase64UrlNoPad(normalizeWorkspaceId(normalized));
+  // Numeric string IDs are URL-safe and don't need encoding.
+  // Legacy path-based IDs still get base64-encoded for safety.
+  const id = normalizeWorkspaceId(normalized);
+  if (isPathLikeWorkspaceIdentity(id)) {
+    return toBase64UrlNoPad(id);
+  }
+  return encodeURIComponent(id);
 }
 
 export function decodeWorkspaceIdFromPathSegment(workspaceIdSegment: string): string | null {
@@ -183,6 +189,12 @@ export function decodeWorkspaceIdFromPathSegment(workspaceIdSegment: string): st
     return normalizeWorkspaceId(decoded);
   }
 
+  // If the segment looks like a plain numeric ID, return it directly.
+  // Do NOT attempt base64 decode on short alphanumeric strings.
+  if (/^\d+$/.test(decoded)) {
+    return decoded;
+  }
+
   const base64Decoded = tryDecodeBase64UrlNoPadUtf8(decoded);
   if (base64Decoded) {
     return normalizeWorkspaceId(base64Decoded);