fix(projects): audit pass — 8 correctness and consistency fixes

- Project.to_dict() now includes user_id and auto_summary
- Status validation unified to (active/completed/archived) on both
  create and update project routes; update route previously had none
- Milestone routes: replace get_project (ownership-only) with
  get_project_for_user so shared viewers/editors can access milestones
- Add get_milestone_in_project() to milestones service for project-
  scoped lookup without user_id filter; all milestone routes use it
- Milestone PATCH now validates status as 'active'|'done'; fix tool
  enum which was wrongly ['active','completed','cancelled']
- Write mutation routes (POST/PATCH/DELETE milestones) now check
  can_write_project() and return 403 for read-only shared users
- update_project tool now exposes title and color fields so projects
  can be renamed or recolored via chat
- create_project tool now exposes color field
- GET /api/projects?include_summary=true embeds summaries in one
  backend pass; ProjectListView switches to this, eliminating N+1
  per-project fetches

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/fabledassistant/routes/projects.py

@@ -1,4 +1,5 @@
 """Project management routes."""
+import asyncio
 import logging
 
 from quart import Blueprint, jsonify, request
@@ -27,7 +28,19 @@ projects_bp = Blueprint("projects", __name__, url_prefix="/api/projects")
 async def list_projects_route():
     uid = get_current_user_id()
     status = request.args.get("status")
+    include_summary = request.args.get("include_summary", "").lower() in ("1", "true")
     projects = await list_projects_for_user(uid, status=status)
+    if include_summary:
+        # Fetch all summaries in parallel — one backend pass instead of N+1 frontend calls
+        async def _attach(project_dict: dict) -> dict:
+            try:
+                owner_uid = project_dict.get("user_id") or uid  # user_id now in to_dict()
+                summary = await get_project_summary(owner_uid, project_dict["id"])
+                project_dict["summary"] = summary
+            except Exception:
+                pass
+            return project_dict
+        projects = list(await asyncio.gather(*[_attach(p) for p in projects]))
     return jsonify({"projects": projects})
 
 
@@ -39,8 +52,8 @@ async def create_project_route():
     if not data.get("title"):
         return jsonify({"error": "title is required"}), 400
     status = data.get("status", "active")
-    if status not in ("active", "archived"):
-        return jsonify({"error": "status must be 'active' or 'archived'"}), 400
+    if status not in ("active", "completed", "archived"):
+        return jsonify({"error": "status must be 'active', 'completed', or 'archived'"}), 400
     project = await create_project(
         uid,
         title=data["title"],
@@ -76,6 +89,8 @@ async def update_project_route(project_id: int):
     data = await request.get_json()
     allowed = {"title", "description", "goal", "status", "color"}
     fields = {k: v for k, v in data.items() if k in allowed}
+    if "status" in fields and fields["status"] not in ("active", "completed", "archived"):
+        return jsonify({"error": "status must be 'active', 'completed', or 'archived'"}), 400
     project = await update_project(uid, project_id, **fields)
     if project is None:
         return not_found("Project")