Surface project ownership/role on the wire and gate the web UI by it

ProjectResponse now carries OwnerId and a server-resolved MyRole so
Editors/Reviewers see read-only fields and no delete/grant-management
affordances instead of only finding out via a 403 after the fact.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PuBH9QSv66DPXSSBERmPs6

src/Novelly.Api/Agent/NovelAgentToolset.cs

@@ -99,7 +99,7 @@ public class NovelAgentToolset(
             "Read the project's title, logline, synopsis, genre, notes and word-count target. "
             + "Call this first in a conversation to ground yourself in what the book is.",
             new JsonSchemaBuilder().Build(),
-            async (projectId, _, ct) => await OrNotFound(projects.GetAsync(projectId, ct), p => p.ToResponse(), "Project", projectId));
+            async (projectId, _, ct) => await OrNotFound(projects.GetAsync(projectId, ct), p => p.ToResponse(null), "Project", projectId));
 
         yield return new AgentTool(
             "update_project_brief",
@@ -121,7 +121,7 @@ public class NovelAgentToolset(
                 JsonInput.String(input, "logline"),
                 JsonInput.String(input, "synopsis"),
                 JsonInput.String(input, "notes"),
-                JsonInput.Int(input, "target_word_count")), ct), p => p.ToResponse(), "Project", projectId));
+                JsonInput.Int(input, "target_word_count")), ct), p => p.ToResponse(null), "Project", projectId));
 
         yield return new AgentTool(
             "list_characters",