feat(projects): M2 — project-scoped authorization + the §22.7 resolver (§22)

Builds the three-tier authorization resolver on M1's schema spine: the
most-permissive union of deployment role (§6.1), project role (§22.6), and
per-RFC authority (§6.3/§12), with the §22.5 visibility gate subtractive on
top (§22.7). Pure app-layer — no migration (M1 shipped the tables), no
behavior change on the public default project. Verifiable on the single
default project by flipping its visibility and granting/revoking roles.

- app/auth.py: the §22.7 resolver primitives — project_visibility,
  project_member_role, project_of_rfc, is_project_superuser, can_read_project,
  effective write/discuss standing (can_contribute_in_project /
  can_discuss_in_project), require_project_readable, visible_project_ids.
  The three per-RFC capability helpers (can_discuss_rfc / can_contribute_to_rfc
  / can_invite_to_rfc) now compose all three tiers, so the ~20 call sites
  inherit M2 unchanged.
- Read pass: the §22.5 visibility gate (404 to non-members) threaded into
  every RFC-resolution helper across api.py / api_branches / api_prs /
  api_graduation / api_discussion / api_contributions / api_invitations, plus
  the catalog + proposals listings filtered by visible_project_ids.
- Write pass: the deep gates (branch read/contribute/owner, PR merge/withdraw/
  edit, graduation, discussion resolve) fold in project_admin via
  is_project_superuser; the "any-contributor" branch mode routes through
  can_contribute_in_project; propose + claim gate on project contribute
  standing. Deployment-level surfaces (admin idea-PR merge/decline, account
  notification-mute) stay deployment-scoped.
- Operator decisions: implicit-on-public (a granted deployment contributor
  keeps its pre-M2 write baseline on a public project, no membership row, so
  the N=1 case stays whole) and preserve-curation (that baseline does not
  override per-RFC owner curation — only an explicit project grant or a
  deployment owner/admin does), keeping the v0.16.0 per-RFC invite contract
  intact on public.
- tests: test_multi_project_authz_vertical.py — 9 vertical assertions on the
  resolver tiers, public-unchanged regression, the gated 404 read gate, the
  gated contribution gate, union + subtractive visibility, and revocation.
  Full suite 390 passed.
- docs: mark Part C M2 "(landed)" with the two operator decisions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/app/api_invitations.py

@@ -126,7 +126,7 @@ def make_router() -> APIRouter:
     @router.post("/api/rfcs/{slug}/invitations")
     async def create_invitation(slug: str, body: CreateInvitationBody, request: Request) -> dict[str, Any]:
         viewer = auth.require_contributor(request)
-        rfc = _require_rfc(slug)
+        rfc = _require_rfc(slug, viewer)
         if not auth.can_invite_to_rfc(viewer, slug):
             raise HTTPException(
                 403,
@@ -151,7 +151,7 @@ def make_router() -> APIRouter:
     @router.get("/api/rfcs/{slug}/invitations")
     async def list_invitations(slug: str, request: Request) -> dict[str, Any]:
         viewer = auth.require_contributor(request)
-        _require_rfc(slug)
+        _require_rfc(slug, viewer)
         if not auth.can_invite_to_rfc(viewer, slug):
             raise HTTPException(
                 403,
@@ -207,7 +207,7 @@ def make_router() -> APIRouter:
     @router.post("/api/rfcs/{slug}/invitations/{invitation_id}/revoke")
     async def revoke_invitation(slug: str, invitation_id: int, request: Request) -> dict[str, Any]:
         viewer = auth.require_contributor(request)
-        _require_rfc(slug)
+        _require_rfc(slug, viewer)
         if not auth.can_invite_to_rfc(viewer, slug):
             raise HTTPException(
                 403,
@@ -373,15 +373,18 @@ def make_router() -> APIRouter:
 # ---------------------------------------------------------------------------
 
 
-def _require_rfc(slug: str):
+def _require_rfc(slug: str, viewer):
     """The invitation surface only operates on a known, non-withdrawn
     RFC. We refuse 404 on unknown and 409 on withdrawn — mirrors the
-    discussion endpoints' `_require_rfc_readable` shape."""
+    discussion endpoints' `_require_rfc_readable` shape. The §22.5
+    visibility gate is subtractive: a gated project's entries 404 to
+    non-members (§22.7)."""
     row = db.conn().execute(
-        "SELECT slug, title, state FROM cached_rfcs WHERE slug = ?", (slug,),
+        "SELECT slug, title, state, project_id FROM cached_rfcs WHERE slug = ?", (slug,),
     ).fetchone()
     if row is None:
         raise HTTPException(404, "RFC not found")
+    auth.require_project_readable(viewer, row["project_id"])
     if row["state"] == "withdrawn":
         raise HTTPException(409, "RFC is withdrawn")
     return row