[Security] Register and implement ProjectPolicy

[ibourgeois]

Problem

Project has no policy registered. Only IdeaPolicy is in AppServiceProvider. Any future project routes would have no authorization layer by default, and currently IdeaController::propose() reuses the update gate on Idea — there is no dedicated project authorization.

Required Changes

• Create app/Policies/ProjectPolicy.php with owner-only access methods (viewAny, view, create, update, delete) comparing $project->user_id === $user->id
• Register Project::class => ProjectPolicy::class in AppServiceProvider

Files

• app/Policies/ProjectPolicy.php (new)
• app/Providers/AppServiceProvider.php