feat(api): 1b·a — Projects route shell (7 routes, REST-corrected)

Part of #10 — Go HTTP Daemon lane. Sub-issue of umbrella #18.

⚠️ Scope: Interface-first. Register 7 canonical project routes as 501 Not Implemented with a structured planned body. No business logic. No real ProjectService impl.

Depends on

feat(backend): HTTP daemon skeleton (Phase 1a) — #10 #14 (Skeleton PR for Tracking: Go HTTP Daemon — REST #10·1a) must be merged first.
Sibling: #18b (Sessions), #18c (Issues+rest), feat(api): 1c — OpenAPI 3.1 spec + request/response validation #19 (OpenAPI follow-up).

Goal

All 7 canonical project routes mounted under /api/v1 with the chi REST timeout group from the skeleton. Each handler returns 501 + {error, code, message, requestId, planned}. Legacy TS paths are NOT registered — see REST audit below.

REST audit (applies across #18a/b/c)

Reading the old TS surface at packages/web/src/app/api/** revealed REST violations. The Go shell corrects them and documents the legacy mapping in planned.legacy + handler comments, instead of registering aliases.

#	TS violation	Go fix
R3	`PUT /projects/:id` aliased to `PATCH`	Keep PATCH only. PUT not registered — chi returns 405.
R4	`POST /projects/:id` overloaded for repair	Canonical `POST /projects/{id}/repair`. Legacy path not registered.
R5	Degraded `GET /:id` returns 200 with `error` field	Discriminator `{project, status:"ok"\|"degraded"}`.
R6	Inconsistent `ok`/`success` flags	Drop on 2xx. Return affected resource.
R9	Bare `{error: msg}`	Locked envelope `{error, code, message, requestId, details?}`.

Route surface (7 canonical)

Method	Path	Notes
GET	`/api/v1/projects`	`200 {projects: ProjectSummary[]}`
POST	`/api/v1/projects`	Add. `201 {project}`. `400 INVALID_JSON\|PATH_REQUIRED\|NOT_A_GIT_REPO`, `409 PATH_ALREADY_REGISTERED\|ID_ALREADY_REGISTERED` with `details.existingProjectId,suggestedProjectId`.
GET	`/api/v1/projects/{id}`	`200 {project, status:"ok"\|"degraded"}`, `404 PROJECT_NOT_FOUND`.
PATCH	`/api/v1/projects/{id}`	`200 {project}`. `400 INVALID_JSON\|IDENTITY_FROZEN\|INVALID_LOCAL_CONFIG`, `404`, `409 PROJECT_DEGRADED\|MISSING_PATH`.
DELETE	`/api/v1/projects/{id}`	`200 {projectId, removedStorageDir}`. `400 INVALID_PROJECT_ID`, `404`.
POST	`/api/v1/projects/{id}/repair`	`200 {project}`. `400 PROJECT_NOT_DEGRADED\|REPAIR_NOT_AVAILABLE`, `404`. planned.legacy: ["POST /api/v1/projects/{id}"] (R4).
POST	`/api/v1/projects/reload`	`200 {reloaded:true, projectCount, degradedCount}`.

chi gotcha: register /projects/reload BEFORE /projects/{id} for POST so reload isn't captured by the wildcard.

Files this PR introduces (shared scaffolding lands here, reused by #18b/c)

backend/internal/
  domain/
    project.go            NEW
    config_types.go       NEW — Zod-ported typed config (TrackerConfig, SCMConfig,
                          AgentConfig, ReactionConfig, LocalProjectConfig, RoleAgentConfig)
                          .passthrough() parity via Extra map + custom Marshal/Unmarshal.
  ports/
    services.go           NEW — ProjectService interface (sessions API port lives in #18b)
  httpd/
    router.go             MODIFIED — mount api.Register
    api.go                NEW — API struct + /api/v1 routing
    notimpl.go            NEW — notImplemented(w, r, PlannedRoute{...})
    errors.go             NEW — writeAPIError(w, r, status, code, message, details)
    controllers/
      projects.go         NEW
      projects_test.go    NEW

Stub envelope (locked)

{
  "error":     "not_implemented",
  "code":      "NOT_IMPLEMENTED",
  "message":   "GET /api/v1/projects is registered but not yet implemented",
  "requestId": "<chi-request-id>",
  "planned": {
    "route":    "GET /api/v1/projects",
    "legacy":   [],
    "request":  { "query": {}, "body": null },
    "response": { "200": { "projects": "[]domain.ProjectSummary" } },
    "errors":   [{ "status": 500, "code": "PROJECTS_LIST_FAILED", "message": "..." }],
    "notes":    "..."
  }
}

Exit criteria

cd backend && go build ./... && go test ./internal/httpd/...
go run ./...
curl -i localhost:3001/api/v1/projects                  # 501 + envelope
curl -i -XPATCH localhost:3001/api/v1/projects/p1       # 501
curl -i -XPUT   localhost:3001/api/v1/projects/p1       # 405 (unregistered)
curl -i -XPOST  localhost:3001/api/v1/projects/p1       # 405 (legacy unregistered)
curl -i -XPOST  localhost:3001/api/v1/projects/p1/repair # 501 + planned.legacy
curl -i -XPOST  localhost:3001/api/v1/projects/reload    # 501
curl -i        localhost:3001/api/v1/missing             # 404 sanity

Out of scope

Real ProjectService implementation.
TS-side compat shims, alias paths.
OpenAPI spec authoring → feat(api): 1c — OpenAPI 3.1 spec + request/response validation #19.
Frontend updates to call canonical paths → separate PR in old orchestrator repo.

Closes part of #18.