fix(projects): require admin for project deletion

[beastpu]

Summary

• require the deleting user to be a workspace owner or admin before deleting a project
• authorize against the project row workspace, not only caller supplied request context
• hide the project detail delete action for non-admin workspace members
• add regression coverage for plain members being denied and admins being allowed

Fixes #4220

Tests

• go test ./internal/handler -run 'TestDeleteProjectRequiresAdminOrOwner|TestDeleteProjectAllowsAdmin|TestCreateProjectValidStatusReturns201|TestUpdateProjectInvalidStatusReturns400'
• pnpm --filter @multica/views typecheck
• git diff --check

Notes

• I also tried a broader project-pattern handler test run. It fails in this local worktree because the shared test database schema is missing unrelated newer schema objects: profile_id and autopilot_subscriber. The targeted project-delete tests above pass.

[vercel]

@beastpu is attempting to deploy a commit to the IndexLabs Team on Vercel.

A member of the Team first needs to authorize it.