§22 M3-backend Plan B (2/2, read path): per-project RFC serving (v0.37.0)

A second project's corpus now renders under /p/<id>/, isolated by its own
slug namespace. Completes step (1) "RFC app supports multiple projects" for
the read path.

- api.py: GET /api/projects/{pid}/rfcs (scoped catalog) + /{slug} (entry by
  (project_id,slug)), behind the §22.5 read gate. Unscoped /api/rfcs stay as
  default-project compat.
- cache.py: refresh_meta_repo iterates every projects row, mirroring each
  content_repo into cached_rfcs stamped with its project_id (_upsert_cached_rfc
  gains a project_id arg).
- frontend: api.listRFCs(projectId)/getRFC(projectId,slug); Catalog + RFCView
  pass useProjectId(); ProjectLayout's NotServedPlaceholder guard removed (every
  project serves), 404/not-readable branch kept; NotServedPlaceholder deleted.
- tests: test_project_scoped_serving.py (catalog scoping, entry isolation,
  gated 404); ProjectLayout.test updated (non-default renders). 445 backend +
  11 Vitest green; clean build.

Known limitation (next slice): write path + default-id re-stamp not yet scoped
(non-default project read-only); no live impact (no 2nd project in prod yet).
Per docs/superpowers/specs/2026-06-04-m3-backend-planb-design.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

frontend/src/components/Catalog.jsx

@@ -34,9 +34,9 @@ export default function Catalog({ viewer, onProposeRFC, version }) {
   const pid = useProjectId()
 
   useEffect(() => {
-    listRFCs().then(d => setRfcs(d.items)).catch(() => setRfcs([]))
+    listRFCs(pid).then(d => setRfcs(d.items)).catch(() => setRfcs([]))
     listProposals().then(d => setProposals(d.items)).catch(() => setProposals([]))
-  }, [version])
+  }, [version, pid])
 
   const filtered = useMemo(() => {
     const needle = search.trim().toLowerCase()