feat: add project-scoped REST access tokens

[luandro]

Summary

• add stateless HMAC-signed project-scoped REST credentials (cpat1)
• add POST /projects/:projectPublicId/accessTokens, restricted to the archive-wide credential
• filter GET /projects and authorize all existing bearer-protected project REST routes by scoped project
• preserve /sync/:projectPublicId and CoMapeo replication semantics unchanged
• document optional PROJECT_ACCESS_TOKEN_SECRET configuration and rotation behavior

Security behavior

• archive-wide SERVER_BEARER_TOKEN retains existing behavior
• malformed, tampered, wrongly-signed, or key-rotated project credentials return 401
• project credentials cannot mint additional credentials
• out-of-scope project requests return the same PROJECT_NOT_FOUND response as nonexistent projects
• remote detection alert writes remain allowed inside the authorized project
• project-scoped token minting returns 501 PROJECT_ACCESS_TOKENS_UNAVAILABLE when the optional signing key is not configured

Validation

• npm run lint
• npm run test:prettier
• npm run build
• npm run test:node — 63/63 passing

Upstream server contract for digidem/comapeo-cloud-app#237.