feat(projects): M2 — project-scoped authorization + the §22.7 resolver (§22)

Builds the three-tier authorization resolver on M1's schema spine: the
most-permissive union of deployment role (§6.1), project role (§22.6), and
per-RFC authority (§6.3/§12), with the §22.5 visibility gate subtractive on
top (§22.7). Pure app-layer — no migration (M1 shipped the tables), no
behavior change on the public default project. Verifiable on the single
default project by flipping its visibility and granting/revoking roles.

- app/auth.py: the §22.7 resolver primitives — project_visibility,
  project_member_role, project_of_rfc, is_project_superuser, can_read_project,
  effective write/discuss standing (can_contribute_in_project /
  can_discuss_in_project), require_project_readable, visible_project_ids.
  The three per-RFC capability helpers (can_discuss_rfc / can_contribute_to_rfc
  / can_invite_to_rfc) now compose all three tiers, so the ~20 call sites
  inherit M2 unchanged.
- Read pass: the §22.5 visibility gate (404 to non-members) threaded into
  every RFC-resolution helper across api.py / api_branches / api_prs /
  api_graduation / api_discussion / api_contributions / api_invitations, plus
  the catalog + proposals listings filtered by visible_project_ids.
- Write pass: the deep gates (branch read/contribute/owner, PR merge/withdraw/
  edit, graduation, discussion resolve) fold in project_admin via
  is_project_superuser; the "any-contributor" branch mode routes through
  can_contribute_in_project; propose + claim gate on project contribute
  standing. Deployment-level surfaces (admin idea-PR merge/decline, account
  notification-mute) stay deployment-scoped.
- Operator decisions: implicit-on-public (a granted deployment contributor
  keeps its pre-M2 write baseline on a public project, no membership row, so
  the N=1 case stays whole) and preserve-curation (that baseline does not
  override per-RFC owner curation — only an explicit project grant or a
  deployment owner/admin does), keeping the v0.16.0 per-RFC invite contract
  intact on public.
- tests: test_multi_project_authz_vertical.py — 9 vertical assertions on the
  resolver tiers, public-unchanged regression, the gated 404 read gate, the
  gated contribution gate, union + subtractive visibility, and revocation.
  Full suite 390 passed.
- docs: mark Part C M2 "(landed)" with the two operator decisions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/app/api_contributions.py

@@ -55,16 +55,19 @@ class ContributionRequestBody(BaseModel):
     use_case: str | None = Field(default=None, max_length=_USE_CASE_MAX)
 
 
-def _require_super_draft(slug: str):
+def _require_super_draft(slug: str, viewer):
     """The contribute surface only operates on a *pending* RFC. 404 on
     unknown; 409 on a state that isn't a super-draft (active RFCs use the
-    Part-1 link, not a contribute offer; withdrawn is closed)."""
+    Part-1 link, not a contribute offer; withdrawn is closed). The §22.5
+    visibility gate is subtractive: a gated project's entries 404 to
+    non-members (§22.7)."""
     row = db.conn().execute(
-        "SELECT slug, title, state, owners_json, proposed_by FROM cached_rfcs WHERE slug = ?",
+        "SELECT slug, title, state, owners_json, proposed_by, project_id FROM cached_rfcs WHERE slug = ?",
         (slug,),
     ).fetchone()
     if row is None:
         raise HTTPException(404, "RFC not found")
+    auth.require_project_readable(viewer, row["project_id"])
     if row["state"] != "super-draft":
         raise HTTPException(409, "RFC is not a pending super-draft")
     return row
@@ -88,7 +91,7 @@ def _viewer_relationship(viewer, slug: str) -> str | None:
     """Why this viewer can't *request* to contribute — or None if they can.
     Owners/admins already have the RFC; existing collaborators are already
     in. Both get a clear 409 rather than a useless self-request."""
-    if auth.is_rfc_owner(viewer, slug) or viewer.role in ("owner", "admin"):
+    if auth.is_rfc_owner(viewer, slug) or auth.is_project_superuser(viewer, auth.project_of_rfc(slug)):
         return "You already own or administer this RFC."
     if auth.is_rfc_collaborator(viewer, slug):
         return "You're already a collaborator on this RFC."
@@ -105,16 +108,18 @@ def make_router() -> APIRouter:
     @router.get("/api/rfcs/{slug}/contribution-target")
     async def contribution_target(slug: str, request: Request) -> dict[str, Any]:
         row = db.conn().execute(
-            "SELECT slug, title, state, owners_json, proposed_by FROM cached_rfcs WHERE slug = ?",
+            "SELECT slug, title, state, owners_json, proposed_by, project_id FROM cached_rfcs WHERE slug = ?",
             (slug,),
         ).fetchone()
         if row is None:
             raise HTTPException(404, "RFC not found")
+        viewer = auth.current_user(request)
+        # §22.5 visibility gate (subtractive): gated → 404 to non-members.
+        auth.require_project_readable(viewer, row["project_id"])
 
         from . import rfc_links  # local import: avoid a module import cycle
 
         owner = rfc_links._owner_display(db.conn(), row["owners_json"], row["proposed_by"])
-        viewer = auth.current_user(request)
 
         eligible = True
         reason: str | None = None
@@ -159,7 +164,7 @@ def make_router() -> APIRouter:
         slug: str, body: ContributionRequestBody, request: Request
     ) -> dict[str, Any]:
         viewer = auth.require_contributor(request)
-        _require_super_draft(slug)
+        _require_super_draft(slug, viewer)
 
         reason = _viewer_relationship(viewer, slug)
         if reason is not None:
@@ -214,7 +219,7 @@ def make_router() -> APIRouter:
         slug: str, request_id: int, request: Request
     ) -> dict[str, Any]:
         viewer = auth.require_contributor(request)
-        rfc = _require_super_draft(slug)
+        rfc = _require_super_draft(slug, viewer)
         if not auth.can_invite_to_rfc(viewer, slug):
             raise HTTPException(403, "Only the RFC's owner can act on contribution requests")
 
@@ -282,7 +287,7 @@ def make_router() -> APIRouter:
         slug: str, request_id: int, request: Request
     ) -> dict[str, Any]:
         viewer = auth.require_contributor(request)
-        _require_super_draft(slug)
+        _require_super_draft(slug, viewer)
         if not auth.can_invite_to_rfc(viewer, slug):
             raise HTTPException(403, "Only the RFC's owner can act on contribution requests")