Project permissions

• projects.view: view project dashboards and all delivery records.
• projects.manage: create/edit projects, tasks, milestones, visits, checklist items, assignments, risks, and ordinary lifecycle/handover state.
• projects.approve: approve kickoff, testing completion, customer handover readiness, and final project closure.

Every page checks view access server-side and every mutation independently checks manage or approve access. Button visibility is not treated as authorization. Actions use the existing append-oriented ActivityLog.