[Bug]: Polyscope API reporting 0 repositories

### Platform

macOS

### Operating system version

Mac OS Tahoe 26.3

### System architecture

ARM64 (M1, M2, etc)

### PolyScope Version

0.17.0

### Bug description

Authenticated calls to `GET /api/v1/repositories` return an empty list for my account, but the local Polyscope server (desktop app) has six repositories registered for that same account. They show up in the UI, and the local server logs show `worktree.list` requests for each of them at startup.

The behaviour is intermittent. Sometimes `/repositories` returns the expected list, sometimes it returns `{"data": []}` with no change on my side. Same token, same account, same local server running. Earlier the same day I successfully POSTed workspaces against IDs returned by this endpoint, so it was working; a few hours later it started returning empty and stayed empty for a stretch; then it returned a partial list (just 1 of 6 repos); then empty again. No API-side mutations from me between the state changes.

Auth isn't the issue. `GET /api/v1/servers` with the same token consistently returns both of my connected servers as `online: true`, including the Mac server whose local log lists the six repo IDs. I also regenerated the token in the UI and the intermittent behaviour is identical with the new token.

Impact: any API client that has to discover a repo by listing first is unreliable. Hard-coded repo IDs still work for `POST /api/v1/workspaces` when they're remembered from a previous successful list call, but fresh setups hit a coin flip on whether the API will return anything.

The six repo IDs the local server tracks (and which `/repositories` should be returning):
7e7c4fd4, 8a23f2e1, 58dc1e37, b8f1a2ac, 813d41ae, 08a13118

### Steps to reproduce

1. Have a Polyscope account with at least one repo registered (visible in the UI, desktop app running and connected to the relay).
2. Generate or regenerate an API token from the Polyscope UI for that account.
3. Hit the endpoint:
curl -H "Authorization: Bearer $TOKEN" https://getpolyscope.com/api/v1/repositories
4. Response is `{"data": []}`.
5. Sanity check the same token against a different endpoint:
curl -H "Authorization: Bearer $TOKEN" https://getpolyscope.com/api/v1/servers
This returns the account's servers correctly, including online status. So the token and auth layer are fine.

**Additional checks that didn't change the outcome:**
- `?all=true`, `?status=all`, `?state=all`, `?include=disconnected`, `?include_unregistered=true` all returned `{"data": []}`.
- `/api/v1/servers//repositories` returns 404.
- Regenerated the token, same result.
- `/api/v1/workspaces` also returns `{"data": []}` for this account, probably correct but worth noting for consistency.

**Rough timeline on the same day (2026-04-22):**
- Around 00:50 local: `/repositories` returned 2 repos.
- Around 10:00 local: returned 1 repo.
- From about 11:30 local onward: returns 0.

No deletions were made through the API between those checks.

### Relevant log output

```shell
[electron] Starting prod server: /Applications/Polyscope.app/Contents/Resources/polyscope-server
[server] [relay-client] Connecting to relay at wss://relay-edge.getpolyscope.com...
[server] [polyscope] Server running on ws://0.0.0.0:4321/ws
[server] [polyscope] REST API: http://0.0.0.0:4321/api
[server] [polyscope] WS upgrade request from 127.0.0.1 localhost: true
[server] [polyscope] Client connected
[server] [ws] received: repo.list {"type":"repo.list"}
[server] [polyscope] Hydrated auth user from stored token
[server] [ws] received: auth.set {"type":"auth.set","user":{"id":,"name":"","email":"","avatar":"","subscribed":true,"on_trial":false,"expose_token":"
[server] [ws] broadcast: auth.status {"type":"auth.status","user":{"id":,"name":"","email":"","avatar":"
[server] [ws] received: worktree.list {"type":"worktree.list","repoId":"7e7c4fd4"}
[server] [ws] received: repo.detect_integrations {"type":"repo.detect_integrations","repoId":"7e7c4fd4"}
[server] [ws] received: worktree.list {"type":"worktree.list","repoId":"8a23f2e1"}
[server] [ws] received: repo.detect_integrations {"type":"repo.detect_integrations","repoId":"8a23f2e1"}
[server] [ws] received: worktree.list {"type":"worktree.list","repoId":"58dc1e37"}
[server] [ws] received: repo.detect_integrations {"type":"repo.detect_integrations","repoId":"58dc1e37"}
[server] [ws] received: worktree.list {"type":"worktree.list","repoId":"b8f1a2ac"}
[server] [ws] received: repo.detect_integrations {"type":"repo.detect_integrations","repoId":"b8f1a2ac"}
[server] [ws] received: worktree.list {"type":"worktree.list","repoId":"813d41ae"}
[server] [ws] received: repo.detect_integrations {"type":"repo.detect_integrations","repoId":"813d41ae"}
[server] [ws] received: worktree.list {"type":"worktree.list","repoId":"08a13118"}
[server] [ws] received: repo.detect_integrations {"type":"repo.detect_integrations","repoId":"08a13118"}
[server] [relay-client] Connected to relay
[server] [relay-client] Registered as server 46b12b9c-30b

Meanwhile, same token, same moment, cloud REST API:
$ curl -H "Authorization: Bearer $POLYSCOPE_TOKEN" https://getpolyscope.com/api/v1/repositories
{"data":[]}

$ curl -H "Authorization: Bearer $POLYSCOPE_TOKEN" https://getpolyscope.com/api/v1/servers
{"data":[
{"id":"46b12b9c-30b","online":true,"platform":"darwin","version":"0.17.0","name":""},
{"id":"a574620f-013","online":true,"platform":"linux","version":"0.17.0","name":""}
]}
```