Live-update the /projects workspace when projects change out of band #24

Outcome

The cross-repository project workspace at /projects updates in place, through LiveView, when any project the viewer can read is created or changed — including changes made from another surface such as the API, a different repository's page, or another viewer's session.

Evidence

The sibling /issues workspace had exactly this gap and it was fixed by subscribing to a global change topic (#14). /projects still renders one mount-time snapshot: a project created over the API does not appear until a manual reload.

Work

• Broadcast a project-change announcement for every committed project write (create, update, close, reopen, delete), on both the owning repository's topic and a global projects:all topic.
• Subscribe the /projects workspace and re-run its authorized read when an announcement arrives — same visibility predicate as the initial load, so private projects never surface for a viewer who cannot read them.
• Coalesce bursts with a re-armed timer so N writes cost one re-read, not N; keep tests at zero debounce with a synchronous path.
• Mirror whatever close/reopen/delete semantics the issues fix shipped, so the two workspaces behave alike.

Acceptance criteria

• A project created over the API appears at /projects within one broadcast cycle without a reload.
• Closing, reopening, updating, and deleting behave the same way.
• Viewers without access see no row for a private project at any point.
• A burst of N writes triggers a bounded number of re-reads.

Verification

LiveView tests asserting stream updates after out-of-band writes, an authorization test with a private project, and mix precommit.