fix(api): /api/projects/:id returns 404 (not 500) for unknown id incl. superusers

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/api_deployment.py

@@ -10,7 +10,7 @@ from __future__ import annotations
 import json
 from typing import Any
 
-from fastapi import APIRouter, Request
+from fastapi import APIRouter, HTTPException, Request
 
 from . import auth, db
 
@@ -53,7 +53,7 @@ def make_router() -> APIRouter:
             (project_id,),
         ).fetchone()
         if row is None:
-            auth.require_project_readable(viewer, project_id)  # raises 404
+            raise HTTPException(status_code=404, detail="Not found")
         cfg = json.loads(row["config_json"] or "{}")
         dep = db.conn().execute("SELECT tagline FROM deployment WHERE id = 1").fetchone()
         return {

backend/tests/test_api_deployment.py

@@ -62,3 +62,17 @@ def test_projects_id_unlisted_readable_by_direct_id(app_with_fake_gitea):
     with TestClient(app) as client:
         _add_project("unl", "Unlisted", "unlisted")
         assert client.get("/api/projects/unl").status_code == 200
+
+
+def test_projects_id_unknown_returns_404_even_for_superuser(app_with_fake_gitea):
+    app, _ = app_with_fake_gitea
+    with TestClient(app) as client:
+        provision_user_row(user_id=1, login="ben", role="owner")
+        sign_in_as(client, user_id=1, gitea_login="ben", display_name="Ben", role="owner")
+        assert client.get("/api/projects/does-not-exist").status_code == 404
+
+
+def test_projects_id_unknown_returns_404_for_anon(app_with_fake_gitea):
+    app, _ = app_with_fake_gitea
+    with TestClient(app) as client:
+        assert client.get("/api/projects/nope").status_code == 404