feat(cli): pic projects ls + §7 M3/track-complete docs

§7 M3 (part 3) — the ownership track becomes inspectable, completing M1–M3.

- server: GET /api/v1/admin/projects (projects_api) lists every project + its
  owned-group count (projects repo list_with_counts, one GROUP BY); behind the
  /admin middleware, like the groups list.
- CLI: pic projects ls (cmds/projects.rs + client projects_list); the
  apply_ownership plan-preview journey now also asserts projects ls (plat owns
  exactly 1 group; teamb listed).
- docs: design §7 + CLAUDE.md record M3 shipped and the whole §7 multi-repo
  ownership track (M1 claim · M2 attach ceiling · M3 preview + projects ls)
  COMPLETE; deferred = structural-divergence + declarative tree shape + per-env
  approval gating.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/lib.rs

@@ -80,6 +80,7 @@ pub mod outbox_event_emitter;
 pub mod outbox_repo;
 pub mod principal_resolver;
 pub mod project_repo;
+pub mod projects_api;
 pub mod pubsub_repo;
 pub mod pubsub_service;
 pub mod queue_repo;
@@ -225,6 +226,7 @@ pub use outbox_repo::{
 };
 pub use principal_resolver::{AdminPrincipalResolver, PrincipalResolver, PrincipalResolverError};
 pub use project_repo::{PostgresProjectRepository, ProjectRepository, ProjectRepositoryError};
+pub use projects_api::{projects_router, ProjectsApiError, ProjectsState};
 pub use pubsub_repo::{PostgresPubsubRepo, PublishCtx, PubsubRepo, PubsubRepoError};
 pub use pubsub_service::{PubsubServiceImpl, SubscriberTokenConfig};
 pub use realtime_authority::RealtimeAuthorityImpl;