Add first-class Projects and Project-bound Sessions

[doodlewind]

Summary

• add first-class User and Team Projects with stable handles, canonical /@handle/project-slug routes, project CRUD, GitHub metadata, Team-private project feeds, and sidebar navigation
• require every hosted Session to belong to a same-tenant Project; add atomic Personal → Team Project transfer and account/team/project-scoped CLI bindings for share, subscribe, and project moves
• move the bilingual Session language control beside Session-bearing content and remove the no-op homepage/account placement
• backfill existing production Sessions into reviewed Projects, including React Vapor, Spool, Paperboy, and the avatar generator
• preserve provider JSON bytes (key order, whitespace, and numeric lexemes) while tokenizing only local paths; repair exact Session identity fields on resume
• repair auto-publish's production SQLite query and make subscriptions fail closed when their Project binding is stale or missing
• make migration 0014_projects.sql rolling-deploy safe for old Hub inserts, Personal → Team transfers, Team creation receipts, and new owner handles

Validation

• pnpm exec vp check
• git diff --check
• core: 48 files, 453 passed, 1 skipped
• session-kit: 10 files, 75 passed
• CLI: 26 files, 233 passed
• backend (non-E2E): 34 files, 530 passed
• Web: 59 files, 355 passed
• D1 schema smoke: all 14 migrations from an empty database
• pnpm run build (packages, CLI, Web client/SSR, 16 prerendered pages)

Release notes

This changes the CLI wire workflow and production schema, so it should ship through the synchronized patch release train after merge.