fix(handlers): log DB Scan/Exec errors previously silently ignored

Four sites had chained DB calls where the error was silently discarded:

approvals.go Create: parent workspace lookup Scan error ignored → if the
DB connection fails, the escalation is silently skipped rather than logged.

approvals.go ListAll: auto-expire ExecContext error ignored → stale
approvals accumulate without logging on DB failure.

terminal.go HandleConnect: instance_id lookup Scan error ignored → if the
workspace row lookup fails, the terminal falls through to local Docker
without any diagnostic.

terminal.go handleLocalConnect: workspace name lookup Scan error ignored →
same pattern as above.

Fix: capture and log each error with handler + workspace context so
operators can diagnose DB connectivity or permission issues.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

workspace-server/internal/handlers/approvals.go

@@ -60,7 +60,9 @@ func (h *ApprovalsHandler) Create(c *gin.Context) {
 
 	// Auto-escalate to parent
 	var parentID *string
-	db.DB.QueryRowContext(ctx, `SELECT parent_id FROM workspaces WHERE id = $1`, workspaceID).Scan(&parentID)
+	if err := db.DB.QueryRowContext(ctx, `SELECT parent_id FROM workspaces WHERE id = $1`, workspaceID).Scan(&parentID); err != nil {
+		log.Printf("Create approval: parent lookup for workspace %s: %v", workspaceID, err)
+	}
 	if parentID != nil {
 		h.broadcaster.RecordAndBroadcast(ctx, string(events.EventApprovalEscalated), *parentID, map[string]interface{}{
 			"approval_id":       approvalID,
@@ -80,10 +82,12 @@ func (h *ApprovalsHandler) ListAll(c *gin.Context) {
 	ctx := c.Request.Context()
 
 	// Auto-expire stale approvals (older than 10 min)
-	db.DB.ExecContext(ctx, `
+	if _, err := db.DB.ExecContext(ctx, `
 		UPDATE approval_requests SET status = 'denied', decided_by = 'auto-expired', decided_at = now()
 		WHERE status = 'pending' AND created_at < now() - interval '10 minutes'
-	`)
+	`); err != nil {
+		log.Printf("ListAll: auto-expire stale approvals: %v", err)
+	}
 
 	rows, err := db.DB.QueryContext(ctx, `
 		SELECT a.id, a.workspace_id, w.name, a.action, a.reason, a.status, a.created_at

workspace-server/internal/handlers/terminal.go

@@ -110,9 +110,11 @@ func (h *TerminalHandler) HandleConnect(c *gin.Context) {
 	// workspace runs as a local Docker container on this tenant.
 	var instanceID string
 	if db.DB != nil {
-		db.DB.QueryRowContext(ctx,
+		if err := db.DB.QueryRowContext(ctx,
 			`SELECT COALESCE(instance_id, '') FROM workspaces WHERE id = $1`,
-			workspaceID).Scan(&instanceID)
+			workspaceID).Scan(&instanceID); err != nil {
+			log.Printf("HandleConnect: instance_id lookup for workspace %s: %v", workspaceID, err)
+		}
 	}
 
 	if instanceID != "" {
@@ -146,7 +148,9 @@ func (h *TerminalHandler) handleLocalConnect(c *gin.Context, workspaceID string)
 	// Look up workspace name for manual container naming
 	var wsName string
 	if db.DB != nil && h.docker != nil {
-		db.DB.QueryRowContext(ctx, `SELECT LOWER(REPLACE(name, ' ', '-')) FROM workspaces WHERE id = $1`, workspaceID).Scan(&wsName)
+		if err := db.DB.QueryRowContext(ctx, `SELECT LOWER(REPLACE(name, ' ', '-')) FROM workspaces WHERE id = $1`, workspaceID).Scan(&wsName); err != nil {
+			log.Printf("HandleConnect: workspace name lookup for %s: %v", workspaceID, err)
+		}
 		if wsName != "" {
 			candidates = append(candidates, wsName)
 		}