[Agent] Private project 404s for signed-in org members

Agent brief

Category: bug | Severity: critical | Effort: M

Problem

Privacy settings say private boards are visible to signed-in workspace members, but all public routes use getPublicProject() which requires is_public = true. Making a project private 404s the entire portal for everyone, including org members and admins using "Open public site".

Repro

1. Admin → Project settings → disable public visibility
2. Visit /{projectSlug} while signed in as org member
3. Observe 404

Files

• src/lib/data/projects.ts — add getProjectForPortal(slug, userId?)
• src/app/[projectSlug]/layout.tsx — use member-aware resolver
• Grep all getPublicProject under src/app/[projectSlug]/

Acceptance criteria

• Org members can view private projects when signed in
• Anonymous users still get 404 for private projects
• Embed/widget routes follow same rule (see related card)

Suggested approach

Extend resolver: return project if is_public OR is_project_member(project.id). Cache carefully per session.

Out of scope

Custom domain routing.