feat(api): projects routes

Add lib/api/routes/projects.js: list by space (with status filter),
create scoped to space, get/patch/delete by id. FK violation from
unknown space_id maps to 400 invalid_space.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/api/projects.test.js

@@ -0,0 +1,60 @@
+import { describe, it, expect, beforeAll, beforeEach } from 'vitest';
+import request from 'supertest';
+import { setup } from './helpers.js';
+import * as spaces from '../../lib/db/repos/spaces.js';
+
+let app, ownerHeaders, space;
+const owner = { kind: 'user', id: null };
+
+beforeAll(async () => { ({ app, ownerHeaders } = await setup()); });
+beforeEach(async () => {
+  space = await spaces.create({ slug: `s-${Date.now()}`, name: 'S' }, owner);
+});
+
+describe('projects routes', () => {
+  it('POST creates with space scope', async () => {
+    const res = await request(app).post(`/api/spaces/${space.id}/projects`).set(ownerHeaders)
+      .send({ slug: 'p', name: 'Proj' });
+    expect(res.status).toBe(201);
+    expect(res.body.space_id).toBe(space.id);
+  });
+
+  it('POST with unknown space → 400 invalid_space', async () => {
+    const res = await request(app)
+      .post('/api/spaces/00000000-0000-0000-0000-000000000000/projects').set(ownerHeaders)
+      .send({ slug: 'p', name: 'Proj' });
+    expect(res.status).toBe(400);
+    expect(res.body.error.code).toBe('validation_failed');
+  });
+
+  it('GET list filters by status', async () => {
+    await request(app).post(`/api/spaces/${space.id}/projects`).set(ownerHeaders)
+      .send({ slug: 'a', name: 'A', status: 'active' });
+    await request(app).post(`/api/spaces/${space.id}/projects`).set(ownerHeaders)
+      .send({ slug: 'b', name: 'B', status: 'idea' });
+    const res = await request(app)
+      .get(`/api/spaces/${space.id}/projects?status=idea`).set(ownerHeaders);
+    expect(res.status).toBe(200);
+    expect(res.body.length).toBe(1);
+    expect(res.body[0].status).toBe('idea');
+  });
+
+  it('PATCH flips status to done without auto-setting completed_at', async () => {
+    const c = await request(app).post(`/api/spaces/${space.id}/projects`).set(ownerHeaders)
+      .send({ slug: 'p', name: 'P' });
+    const res = await request(app).patch(`/api/projects/${c.body.id}`).set(ownerHeaders)
+      .send({ status: 'done' });
+    expect(res.status).toBe(200);
+    expect(res.body.status).toBe('done');
+    expect(res.body.completed_at).toBeNull();
+  });
+
+  it('DELETE then GET → 404', async () => {
+    const c = await request(app).post(`/api/spaces/${space.id}/projects`).set(ownerHeaders)
+      .send({ slug: 'gone', name: 'Gone' });
+    const del = await request(app).delete(`/api/projects/${c.body.id}`).set(ownerHeaders);
+    expect(del.status).toBe(204);
+    const g = await request(app).get(`/api/projects/${c.body.id}`).set(ownerHeaders);
+    expect(g.status).toBe(404);
+  });
+});