feat(admin): gate project surfaces behind permission grants for members

The org admin SPA was org-admin only: every project route used
requireOrgRole, so a plain MEMBER could not reach the projects they held
a project grant on, and an org OWNER/ADMIN could mutate any project
without holding the project's `manage` grant. That contradicts ADR-0004
(spec `Permission.lean`): org role is not a project authorization root,
and the only out-of-role override is platform-admin force-release
(`RequiresAdmin`), not org admin.

Add `requireProjectPermission` (guards.ts): resolve any org member, bind
the project to their org, then check the PermissionGrant authorizer.
`allowOrgAdminOversight=true` lets OWNER/ADMIN through for *read*
oversight only; mutations pinned to `collaborator.manage`
(grant/revoke team-access) pass `allowOrgAdminOversight=false`, so an org
admin still needs the project MANAGE grant to mutate access. The project
detail GET now also returns `actorIsOrgAdmin` and `actorCanManageProject`
so the SPA can render mutation controls only for entitled actors.

Add a member-facing project surface:
- `GET /api/org/:orgSlug/my-projects` + `listMyProjects` resolve the
  actor's principals and return the projects with a READ+ grant.
- The SPA routes members (non-admin) to the projects page instead of the
  admin overview, renders a member project shell on project routes, shows
  a `我的项目` list for members and the full folder explorer for admins.
- The project detail page gates rename/archive/bind/sessions behind org
  admin and the grant/revoke UI behind `actorCanManageProject`.
- The denied panel now points members at their authorized projects.

Update admin-members-teams integration test: seed the owner with a MANAGE
grant on the test project so the org-owner flow still passes the new
project-level gate on team-access grant/revoke.

hub/admin-web/src/routes/+layout.svelte

@@ -41,6 +41,11 @@
 		return null;
 	}
 
+	function isOnProjectRoute(): boolean {
+		const parts = page.url.pathname.split('/').filter(Boolean);
+		return parts[0] === 'admin' && parts[1] === 'org' && parts[3] === 'projects';
+	}
+
 	function memberships(): OrgMembership[] {
 		return $session.me?.organizations ?? [];
 	}
@@ -104,22 +109,50 @@
 
 	$effect(() => {
 		if ($session.loading || !$session.me) return;
-		const admins = adminOrgs();
-		if (admins.length === 0) return;
 
 		const slug = orgSlugFromPath();
 		const matched = slug ? memberships().find((o) => o.slug === slug) : null;
+
+		// Org admins: route to their first admin org if none matched as admin.
+		const admins = adminOrgs();
 		if (matched && isAdmin(matched)) {
 			redirecting = false;
 			return;
 		}
-
-		if (!matched) {
+		if (!matched && admins.length > 0) {
 			const target = `/admin/org/${admins[0].slug}`;
 			if (page.url.pathname !== target && !page.url.pathname.startsWith(`${target}/`)) {
 				redirecting = true;
 				void goto(target, { replaceState: true });
 			}
+			return;
+		}
+
+		// Members (non-admin): project pages are open to project MANAGE holders;
+		// the org overview and other admin-only surfaces are not for them.
+		if (matched && !isAdmin(matched)) {
+			redirecting = false;
+			const parts = page.url.pathname.split('/').filter(Boolean);
+			const onOverview = parts.length === 3; // /admin/org/:slug
+			if (onOverview) {
+				const target = `/admin/org/${matched.slug}/projects`;
+				if (page.url.pathname !== target) {
+					redirecting = true;
+					void goto(target, { replaceState: true });
+				}
+			}
+			return;
+		}
+
+		// No matched org and no admin orgs: route a member to their first org's
+		// projects page so they can reach project MANAGE surfaces.
+		if (!matched && memberships().length > 0) {
+			const home = memberships()[0];
+			const target = `/admin/org/${home.slug}/projects`;
+			if (page.url.pathname !== target && !page.url.pathname.startsWith(`${target}/`)) {
+				redirecting = true;
+				void goto(target, { replaceState: true });
+			}
 		}
 	});
 </script>
@@ -271,6 +304,45 @@
 			</main>
 		</div>
 	</div>
+{:else if currentOrg() && !isAdmin(currentOrg()!) && isOnProjectRoute()}
+	{@const org = currentOrg()!}
+	{@const me = $session.me!}
+	<div class="saas-shell">
+		<div class="saas-main">
+			<header class="saas-topbar">
+				<a
+					href={`/admin/org/${org.slug}/projects`}
+					class="saas-btn-ghost px-2!"
+					aria-label="返回项目列表"
+				>
+					<Icon name="menu" class="h-5 w-5" />
+				</a>
+				<div class="min-w-0">
+					<div class="flex items-center gap-1.5 text-xs text-surface-600">
+						<span class="truncate">{org.name}</span>
+						<span>/</span>
+						<span class="truncate font-medium text-surface-900">项目</span>
+					</div>
+				</div>
+				<div class="ml-auto flex items-center gap-2">
+					<span class="saas-badge-neutral font-mono">/{org.slug}</span>
+					<button
+						type="button"
+						class="p-1.5 text-surface-600 transition hover:bg-surface-200 hover:text-error-700"
+						title="退出登录"
+						onclick={handleLogout}
+					>
+						<Icon name="logout" class="h-4 w-4" />
+					</button>
+				</div>
+			</header>
+			<main class="saas-content">
+				<div class="saas-content-inner">
+					{@render children()}
+				</div>
+			</main>
+		</div>
+	</div>
 {:else if currentOrg() && !isAdmin(currentOrg()!)}
 	{@const denied = currentOrg()!}
 	<div class="saas-status-panel">
@@ -278,37 +350,27 @@
 			<h2 class="mb-2 text-lg font-semibold">无权访问管理后台</h2>
 			<p class="mb-3 text-sm text-surface-700">
 				组织 <strong>{denied.name}</strong>（/{denied.slug}）中你的角色是
-				<span class="saas-badge-neutral mx-1">{orgRoleLabel(denied.role)}</span>， 需要<strong>所有者</strong>或<strong
-					>管理员</strong
-				>。
+				<span class="saas-badge-neutral mx-1">{orgRoleLabel(denied.role)}</span>。普通成员仅可访问自己有授权的项目。
 			</p>
+			<a class="saas-btn-primary" href={`/admin/org/${denied.slug}/projects`}>查看我的项目</a>
 			{#if memberships().length > 1}
-				<p class="saas-label text-left mb-1.5">切换到其他组织</p>
+				<p class="saas-label text-left mb-1.5 mt-3">切换到其他组织</p>
 				<div class="mb-4">
 					<SelectField items={orgSelectItems(memberships())} value={denied.slug} onchange={switchOrg} />
 				</div>
 			{/if}
-			<button class="saas-btn-ghost" onclick={handleLogout}>退出登录</button>
+			<button class="saas-btn-ghost mt-3" onclick={handleLogout}>退出登录</button>
 		</div>
 	</div>
 {:else if memberships().length > 0}
 	{@const denied = pickHomeOrg()!}
 	<div class="saas-status-panel">
 		<div class="saas-status-card">
-			{#if adminOrgs().length === 0}
-				<h2 class="mb-2 text-lg font-semibold">无权访问管理后台</h2>
-				<p class="mb-5 text-sm text-surface-700">
-					你加入了 <strong>{denied.name}</strong>，角色是
-					<span class="saas-badge-neutral mx-1">{orgRoleLabel(denied.role)}</span>。仅所有者与管理员可进入后台。
-				</p>
-			{:else}
-				<h2 class="mb-2 text-lg font-semibold">正在跳转…</h2>
-				<p class="mb-5 text-sm text-surface-700">
-					即将进入 <strong>{adminOrgs()[0].name}</strong>
-					（/{adminOrgs()[0].slug}）。
-				</p>
-				<a class="saas-btn-primary" href={`/admin/org/${adminOrgs()[0].slug}`}>立即进入</a>
-			{/if}
+			<h2 class="mb-2 text-lg font-semibold">正在跳转…</h2>
+			<p class="mb-5 text-sm text-surface-700">
+				即将进入 <strong>{denied.name}</strong>（/{denied.slug}）的项目。
+			</p>
+			<a class="saas-btn-primary" href={`/admin/org/${denied.slug}/projects`}>立即进入</a>
 			<button class="saas-btn-ghost mt-3" onclick={handleLogout}>退出登录</button>
 		</div>
 	</div>