feat: add restricted project access and integration grants (AXI-181)

[Codename-11]

Summary

• add workspace-visible and restricted projects with explicit Viewer, Contributor, and Manager grants
• enforce project privacy across direct reads, mutations, search, dashboards, resources, analytics, notifications, and realtime delivery
• separate credential-owner consent from typed user, agent, API-key, and automation integration grants
• revalidate personal/session keys against live user, membership, role, and project authority
• add Project Access and Integration Access management surfaces with impact previews and accessible responsive states

Security model

Effective external authority is the intersection of current workspace membership, project access, owner consent, principal capabilities, mapping state/direction, API-key narrowing, and provider/GitHub App authority. Admin status does not bypass credential consent, and secondary resource grants never widen restricted-project access.

Verification

• pnpm ci:local:quality: 1,625 passed, 1 intentional skip
• full Playwright: 62 passed, 1 intentional skip; one state-dependent assertion corrected afterward
• focused Project Access Playwright after correction: 3/3 passed
• fresh migration chain applied successfully
• lint and typecheck passed

Implements AXI-181. Exact-head GitHub CI is required before merge.