[bbedward]

What

Someone can now be invited to one project instead of the whole team. They see the team with that project in it and nothing else, and act in the project by role, including through API keys and MCP.

How

• Data: groups.project_id and invitations.project_id, both nullable with cascade delete. A project gets admin, editor and viewer role groups when its first member is added, each holding one grant on the project. The permission checker already resolved project grants and path visibility, so it is unchanged.
• API: the team member and invitation endpoints take an optional project_id. With it they act on the project and require a role on the project, which a team role also satisfies. No new endpoints.
• Web: the project Members tab renders the team members components scoped to the project. Team members show there as read-only rows.
• Invitation link: the accept page and the mails name the project.
• Project delete: removes the project's role groups, invitations and the grants that named it.

Also changed

get-volume-metrics required a team role, so a project member or a key limited to a project could not read usage of a volume in their own project. It now passes for a viewer of the team, project or environment the volume belongs to. The team must be visible to the caller first, and a volume they cannot view answers not found like a missing one.

Tested

Go tests cover project role groups, project invitations, the project member list, and cleanup on project delete.

Ran the branch against the local dev stack with a headless browser and a fresh project-only account, 59 of 59 checks passed:

• invite from the project Members tab, accept, sign in
• sees one team and one project. The other project, its services and volumes, team members, team variables and team volumes are hidden or refused
• as editor: creates services and volumes, sets variables, lists deployments and replicas. Cannot delete or invite
• as project admin: invites to that project. Refused on the other project and on the team
• API keys limited to the project and full access keys: MCP lists and creates in the project, refused on the other project
• after removal: no teams, and the API key reaches nothing

Not covered by the run:

• Logs and metrics were checked only up to authorization. Loki and VictoriaMetrics were not running because the dev cluster node had disk pressure.
• Connected apps were not exercised. They share the access validation with API keys (keyaccess.RequesterHolds).

Notes

• S3 storage stays a team resource. A project member cannot list the team's buckets.
• The team page still shows New Project to someone without a team role. The API refuses it. Same as for a team viewer today.
• ComingSoonCard has no users left. Not removed here.