fix(handlers): add rows.Err() checks to loadWorkspaceSecrets

loadWorkspaceSecrets() iterates over global_secrets and
workspace_secrets rows without checking rows.Err() after the loop.
If the connection is interrupted mid-iteration, the error is silently
ignored. Add the standard deferred Err() check (pattern from
secrets.go, org_helpers.go) to both loops.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

workspace-server/internal/handlers/workspace_provision.go

@@ -805,6 +805,9 @@ func loadWorkspaceSecrets(ctx context.Context, workspaceID string) (map[string]s
 				envVars[k] = string(decrypted)
 			}
 		}
+		if err := globalRows.Err(); err != nil {
+			log.Printf("Provisioner: global_secrets rows.Err workspace=%s: %v", workspaceID, err)
+		}
 	}
 	wsRows, err := db.DB.QueryContext(ctx,
 		`SELECT key, encrypted_value, encryption_version FROM workspace_secrets WHERE workspace_id = $1`, workspaceID)
@@ -823,6 +826,9 @@ func loadWorkspaceSecrets(ctx context.Context, workspaceID string) (map[string]s
 				envVars[k] = string(decrypted)
 			}
 		}
+		if err := wsRows.Err(); err != nil {
+			log.Printf("Provisioner: workspace_secrets rows.Err workspace=%s: %v", workspaceID, err)
+		}
 	}
 	return envVars, ""
 }