test(traces): add HTTP success and error coverage for List handler

- TestTracesList_LangfuseSuccess: verifies 200 with raw body proxied
  through, Content-Type: application/json, and Basic Auth forwarding.
- TestTracesList_LangfuseHTTPError: verifies non-2xx status codes (503)
  are forwarded verbatim — handler must NOT convert them to 200.
- Extracts shared withLangfuseEnv helper to keep env-setup DRY across
  the new HTTP-layer tests.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

workspace-server/internal/handlers/traces_test.go

@@ -107,3 +107,88 @@ func TestTracesList_LangfuseUnreachable(t *testing.T) {
 		t.Errorf("expected empty list when Langfuse unreachable, got %d items", len(resp))
 	}
 }
+
+// withLangfuseEnv sets all three required env vars pointing at ts and
+// arranges a deferred cleanup.
+func withLangfuseEnv(t *testing.T, ts *httptest.Server) {
+	os.Setenv("LANGFUSE_HOST", ts.URL)
+	os.Setenv("LANGFUSE_PUBLIC_KEY", "pk-test")
+	os.Setenv("LANGFUSE_SECRET_KEY", "sk-test")
+	t.Cleanup(func() {
+		os.Unsetenv("LANGFUSE_HOST")
+		os.Unsetenv("LANGFUSE_PUBLIC_KEY")
+		os.Unsetenv("LANGFUSE_SECRET_KEY")
+	})
+}
+
+func TestTracesList_LangfuseSuccess(t *testing.T) {
+	setupTestDB(t)
+	setupTestRedis(t)
+	handler := NewTracesHandler()
+
+	wantBody := `[{"id":"t1","name":"trace-1"},{"id":"t2","name":"trace-2"}]`
+
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Verify Basic Auth headers were forwarded
+		user, pass, ok := r.BasicAuth()
+		if !ok || user != "pk-test" || pass != "sk-test" {
+			t.Errorf("expected BasicAuth(pk-test,sk-test), got (%q,%q)", user, pass)
+		}
+		// Verify the request was a GET
+		if r.Method != http.MethodGet {
+			t.Errorf("expected GET, got %s", r.Method)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(wantBody))
+	}))
+	defer ts.Close()
+
+	withLangfuseEnv(t, ts)
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "ws-success"}}
+	c.Request = httptest.NewRequest("GET", "/workspaces/ws-success/traces", nil)
+
+	handler.List(c)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+	if ct := w.Header().Get("Content-Type"); ct != "application/json" {
+		t.Errorf("expected Content-Type application/json, got %q", ct)
+	}
+	if got := w.Body.String(); got != wantBody {
+		t.Errorf("body mismatch:\nwant: %s\n got: %s", wantBody, got)
+	}
+}
+
+func TestTracesList_LangfuseHTTPError(t *testing.T) {
+	setupTestDB(t)
+	setupTestRedis(t)
+	handler := NewTracesHandler()
+
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusServiceUnavailable)
+		_, _ = w.Write([]byte(`{"error":"upstream overloaded"}`))
+	}))
+	defer ts.Close()
+
+	withLangfuseEnv(t, ts)
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "ws-err"}}
+	c.Request = httptest.NewRequest("GET", "/workspaces/ws-err/traces", nil)
+
+	handler.List(c)
+
+	// Non-2xx must be forwarded as-is — not converted to 200
+	if w.Code != http.StatusServiceUnavailable {
+		t.Errorf("expected 503, got %d: %s", w.Code, w.Body.String())
+	}
+	if got := w.Body.String(); got != `{"error":"upstream overloaded"}` {
+		t.Errorf("expected raw error body, got: %s", got)
+	}
+}