Unique constraint on workspace members

Enforces one member row per user per workspace. A pre-sync patch removes duplicates first.