laddr-import: tick the slug-reachability validation criterion now that read-api has landed

[themightychris]

Background

The laddr-import plan (PR #24) left this Validation criterion unchecked:

• All laddr slugs are accessible via /projects/:slug and /members/:slug after the import (verified via API test on a sample of 100 random records)

…with a Notes line claiming "those routes are owned by read-api and aren't built yet." That's not accurate at the time the PR was opened — read-api (PR #22) merged at 17:50 UTC; laddr-import's PR opened at 22:29 UTC. The /api/projects/:slug and /api/people/:slug endpoints existed.

What to do

Add an end-to-end test that:

1. Runs the importer against apps/api/scripts/fixtures/laddr-fixture.sql into a createTestRepo() + createTestPrivateStore().
2. Boots buildApp({ overrideEnv: { CFP_DATA_REPO_PATH: <the test repo path>, ... } }).
3. Picks 100 random imported records (or all of them if the fixture has fewer); for each, asserts GET /api/projects/<slug> and/or GET /api/people/<slug> returns the documented response shape.
4. Ticks the validation criterion in the plan.

Note: plans are frozen after merge, so the tick happens in this issue's PR via a small docs amendment under "Notes" rather than rewriting the criterion. Add a line like "Validation criterion 9 (slug reachability) closed out via Issue #N's tests; see [link]."

Why bother

Closes the loop on a real validation gap. The import is one-shot — wrong slug → wrong URL forever. The test costs ~5min to write and pays for itself the first time it catches a slugify mistake.