Projects: shareable, registry-backed, container-mounted; drop ticket board

Rework projects from single-user leftovers into shareable endeavours.

- DB: move `projects` from the owner bucket to the registry (system.db,
  not encrypted); add `owner_user_id` + `slug` (drop free `path`); new
  `project_members(project_id, user_id, can_write)` mirroring
  `shared_folder_members`. Drop `project_tickets` entirely. Only user↔agent
  conversations stay encrypted (per-user DB) — each member keeps a private
  project chat. Registry home dissolves the cross-DB-FK problem.
- Filesystem/container: on disk `{WD}/projects/{owner_userid}/{slug}`,
  agent/container path `projects/{owner_username}/{slug}`. Two-segment routing
  in UserFs (ProjectMount + host_base_and_tail arm) and a second loop in
  build_user_fs; read-only members get a :ro mount. Reuse the shared-folder
  remount machinery (refresh_user_shared_folders -> refresh_user_mounts).
- Remove the ticket system: ProjectTicketManager, UserContext.tickets, its
  wiring, and the project_tickets references in scheduled_jobs/cron.
- API: repoint handlers to the registry pool + membership scoping. Sharing is
  self-service — owner or any write-member may add/remove members and set
  read/write; only the owner deletes; the owner cannot be removed. New
  POST/DELETE /api/projects/{id}/members[/{user_id}]. Seed `@fs_any allow
  projects/*`; build_runtime_run_context sets working_directory to the agent
  path and drops the host-path allow_fs_writes.
- Frontend: create form without the free path field, owner/read-write badges;
  the detail page becomes header + description + sharing panel + Open chat + a
  file-explorer placeholder (the future primary surface). i18n en/it/fr.

crates/skald-core/src/cron/mod.rs

@@ -663,16 +663,6 @@ async fn cleanup_expired_single_runs(pool: &SqlitePool) -> Result<()> {
                              AND enabled    = 0
                              AND last_run_at < datetime('now', '-7 days')";
 
-    // Clear the soft back-reference from project_tickets first: its job_id FK has
-    // no ON DELETE action, so a ticket still pointing at an expired runner job
-    // would block the DELETE below with a FOREIGN KEY constraint failure. The
-    // ticket keeps its result/error — only the (now-GC'd) job pointer is dropped.
-    sqlx::query(sqlx::AssertSqlSafe(format!(
-        "UPDATE project_tickets SET job_id = NULL WHERE job_id IN ({EXPIRED})"
-    )))
-    .execute(pool)
-    .await?;
-
     sqlx::query(sqlx::AssertSqlSafe(format!(
         "DELETE FROM job_runs WHERE job_id IN ({EXPIRED})"
     )))