Stop throwing for not-found; add Guard and request validation

Not-found lookups return null/false instead of throwing NotFoundException
across all services — a missing row is expected control flow, not an
exceptional condition. NotFoundException stays for embedded precondition
checks inside mutations (missing parent, invalid foreign reference).

Guard (copied from mic-check) enforces required arguments at the top of
every service method. A ported IModelValidator<T> framework validates
every request DTO at the API layer via a new ValidationEndpointFilter,
returning a 400 with field-level messages; services re-run the same
validator and throw for direct callers that bypass the API.

Endpoints translate null/false into 404 via a new ToApiResult() helper.
The agent toolset boundary translates the same nullable/bool results
into the tool-error text the model already expected.

src/Novelly.Api/Projects/ProjectService.cs

@@ -1,10 +1,15 @@
 using Microsoft.EntityFrameworkCore;
 using Novelly.Api.Common;
+using Novelly.Api.Common.Validation;
 using Novelly.Api.Data;
 
 namespace Novelly.Api.Projects;
 
-public class ProjectService(INovelDbContext db, ILogger<ProjectService> logger)
+public class ProjectService(
+    INovelDbContext db,
+    ILogger<ProjectService> logger,
+    IModelValidator<CreateProjectRequest> createValidator,
+    IModelValidator<UpdateProjectRequest> updateValidator)
 {
     public async Task<IReadOnlyList<ProjectSummaryDto>> ListAsync(CancellationToken ct = default)
     {
@@ -26,14 +31,20 @@ public class ProjectService(INovelDbContext db, ILogger<ProjectService> logger)
             .ToListAsync(ct);
     }
 
-    public async Task<ProjectDto> GetAsync(Guid id, CancellationToken ct = default)
+    /// <summary>Null when no project has this id — a lookup miss is expected, not exceptional.</summary>
+    public async Task<ProjectDto?> GetAsync(Guid id, CancellationToken ct = default)
     {
+        Guard.Default(id, nameof(id));
+
         logger.LogInformation("Getting project {ProjectId}", id);
-        return (await FindAsync(id, ct)).ToDto();
+        return (await FindAsync(id, ct))?.ToDto();
     }
 
     public async Task<ProjectDto> CreateAsync(CreateProjectRequest request, CancellationToken ct = default)
     {
+        Guard.Null(request, nameof(request));
+        createValidator.Validate(request).ThrowIfInvalid();
+
         logger.LogInformation("Creating project {Title}", request.Title);
 
         var project = new Project
@@ -52,11 +63,19 @@ public class ProjectService(INovelDbContext db, ILogger<ProjectService> logger)
         return project.ToDto();
     }
 
-    public async Task<ProjectDto> UpdateAsync(Guid id, UpdateProjectRequest request, CancellationToken ct = default)
+    public async Task<ProjectDto?> UpdateAsync(Guid id, UpdateProjectRequest request, CancellationToken ct = default)
     {
+        Guard.Default(id, nameof(id));
+        Guard.Null(request, nameof(request));
+        updateValidator.Validate(request).ThrowIfInvalid();
+
         logger.LogInformation("Updating project {ProjectId}", id);
 
         var project = await FindAsync(id, ct);
+        if (project is null)
+        {
+            return null;
+        }
 
         project.Title = Patch.Apply(project.Title, request.Title) ?? project.Title;
         project.Author = Patch.Apply(project.Author, request.Author);
@@ -71,27 +90,38 @@ public class ProjectService(INovelDbContext db, ILogger<ProjectService> logger)
         return project.ToDto();
     }
 
-    public async Task DeleteAsync(Guid id, CancellationToken ct = default)
+    /// <summary>True if a project was deleted; false if no project had this id.</summary>
+    public async Task<bool> DeleteAsync(Guid id, CancellationToken ct = default)
     {
+        Guard.Default(id, nameof(id));
+
         logger.LogInformation("Deleting project {ProjectId}", id);
 
         var project = await FindAsync(id, ct);
+        if (project is null)
+        {
+            return false;
+        }
+
         db.Projects.Remove(project);
         await db.SaveChangesAsync(ct);
+        return true;
     }
 
-    private async Task<Project> FindAsync(Guid id, CancellationToken ct)
+    private async Task<Project?> FindAsync(Guid id, CancellationToken ct)
     {
         logger.LogDebug("Finding project {ProjectId}", id);
 
         var project = await db.Projects.FirstOrDefaultAsync(p => p.Id == id, ct);
         if (project is null)
         {
-            logger.LogWarning("Project {ProjectId} not found", id);
-            throw new NotFoundException(nameof(Project), id);
+            logger.LogInformation("Project {ProjectId} not found", id);
+        }
+        else
+        {
+            logger.LogDebug("Found project {ProjectId}", id);
         }
 
-        logger.LogDebug("Found project {ProjectId}", id);
         return project;
     }
 }