feat(web): add authenticated project BFF

[seonghobae]

Advances #209 as a dependency-ordered child of #214. This bounded slice adds the authenticated Project create/list browser boundary beneath a Goal. It must derive workspace authority from Identity, validate the opaque UUIDv4 parent Goal identifier before any dependency access, sign the exact Planning method/path, forward no browser credential to Planning, fail closed on workspace/parent/schema mismatches, reject duplicate or oversized project collections, and expose only browser-safe Project evidence.

Test-first RED is commit 91910fbdcb47aa80008cf8fd1f9d246a17f13111, which deliberately requires the Project handlers before production implementation. Keep this PR Draft until the focused contract is GREEN, the parent #214 dependency is integrated/rebased without destructive history, and exact-head CI/security/review/live-base gates are satisfied. This slice adds no workspace UI and does not close #209.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by #237 after verified complete non-force ancestry repair. #214 advanced from this PR's historical base only by ancestry with zero file delta. #237 head 724ef1fec75852c1afc2273c9c8f8b2ad0ae9abb descends from both this exact head c3937124f1f77ce94821ae9d1b5358e1f654a818 and current #214 head 6dbd0ae72ffc952eca18d798d01c99c88d952275; fresh compare from current #214 is ahead-only and retains exactly this PR's six changed paths. No predecessor checks/reviews transfer.