feat(mcp): add project CRUD tools - #32

Summary

• MCP tools: list_projects, create_project, update_project, delete_project, reorder_projects
• delete_project requires confirm: true and returns 409 if the project has children or tasks
• update_task.projectId accepts null (Inbox) and clears columnId
• /projects accepts API tokens (JwtOrApiTokenGuard) so MCP can call them

Test plan

• list_projects returns lean fields only
• Create nested project via parentId
• update_task with projectId: null moves to Inbox
• delete_project without confirm fails schema; with children/tasks → 409
• MCP token can GET/POST /projects (JWT still works from the web app)