feat(web): add authenticated project BFF

[seonghobae]

Advances #209 as the dependency-ordered child of the current #214 head. This is the canonical non-force successor to #223.

#214 advanced from historical child base 82f39cff2aa5a1f105ad13588dc7f7e2920a1f04 to 6dbd0ae72ffc952eca18d798d01c99c88d952275 only by ancestry: fresh compare reports zero changed files. The predecessor #223 exact head is c3937124f1f77ce94821ae9d1b5358e1f654a818. Successor 724ef1fec75852c1afc2273c9c8f8b2ad0ae9abb is a two-parent descendant of both heads and intentionally preserves the predecessor tree unchanged. Fresh compare from current #214 to the successor is ahead-only and contains exactly the six Project-BFF paths from #223. No predecessor check/review evidence transfers.

The bounded slice derives workspace authority from Identity, validates opaque UUIDv4 Goal identity before dependency access, signs the exact Planning method/path, forwards no browser credential to Planning, rejects workspace/parent/schema mismatches and duplicate/oversized collections, preserves tenant-indistinguishable missing-parent semantics, and exposes browser-safe Project evidence. The original RED lineage beginning 91910fbdcb47aa80008cf8fd1f9d246a17f13111 is preserved in ancestry.

Keep Draft while #214 remains unmerged. After its prerequisite integrates, retarget/restack non-destructively and acquire fresh exact-head repository/central CI, security, coverage and review evidence.

Refs #209, #214, #223.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}