Stop throwing for not-found; add Guard and request validation

Not-found lookups return null/false instead of throwing NotFoundException
across all services — a missing row is expected control flow, not an
exceptional condition. NotFoundException stays for embedded precondition
checks inside mutations (missing parent, invalid foreign reference).

Guard (copied from mic-check) enforces required arguments at the top of
every service method. A ported IModelValidator<T> framework validates
every request DTO at the API layer via a new ValidationEndpointFilter,
returning a 400 with field-level messages; services re-run the same
validator and throw for direct callers that bypass the API.

Endpoints translate null/false into 404 via a new ToApiResult() helper.
The agent toolset boundary translates the same nullable/bool results
into the tool-error text the model already expected.

src/Novelly.Api/Projects/ProjectEndpoints.cs

@@ -1,4 +1,5 @@
 using Novelly.Api.Common;
+using Novelly.Api.Common.Validation;
 
 namespace Novelly.Api.Projects;
 
@@ -6,14 +7,16 @@ public static class ProjectEndpoints
 {
     public static IEndpointRouteBuilder MapProjectEndpoints(this IEndpointRouteBuilder app)
     {
-        var group = app.MapGroup("/api/projects").WithTags("Projects").AddEndpointFilter<RequestLoggingEndpointFilter>();
+        var group = app.MapGroup("/api/projects").WithTags("Projects")
+            .AddEndpointFilter<RequestLoggingEndpointFilter>()
+            .AddEndpointFilter<ValidationEndpointFilter>();
 
         group.MapGet("/", async (ProjectService service, CancellationToken ct) =>
                 Results.Ok(await service.ListAsync(ct)))
             .WithSummary("List all novel projects.");
 
         group.MapGet("/{id:guid}", async (Guid id, ProjectService service, CancellationToken ct) =>
-                Results.Ok(await service.GetAsync(id, ct)))
+                (await service.GetAsync(id, ct)).ToApiResult())
             .WithSummary("Read a project's brief.");
 
         group.MapPost("/", async (CreateProjectRequest request, ProjectService service, CancellationToken ct) =>
@@ -25,14 +28,11 @@ public static class ProjectEndpoints
 
         group.MapPatch("/{id:guid}", async (
                 Guid id, UpdateProjectRequest request, ProjectService service, CancellationToken ct) =>
-                Results.Ok(await service.UpdateAsync(id, request, ct)))
+                (await service.UpdateAsync(id, request, ct)).ToApiResult())
             .WithSummary("Update a project's brief.");
 
         group.MapDelete("/{id:guid}", async (Guid id, ProjectService service, CancellationToken ct) =>
-            {
-                await service.DeleteAsync(id, ct);
-                return Results.NoContent();
-            })
+                await service.DeleteAsync(id, ct) ? Results.NoContent() : Results.NotFound())
             .WithSummary("Delete a project and everything in it.");
 
         return app;