Add users, roles, and per-novel permissions

Introduces accounts (ASP.NET Identity + cookie auth), four global
roles (Admin/Writer/Editor/Reviewer), per-novel ownership and grants
via ProjectMember, and a service-API-key principal for the MCP server
and background import jobs. Enforcement lives in the application
services (not endpoint filters) so the embedded agent and MCP tools,
which call the same services directly, can't bypass it. Web client
gets a login page, session-aware routing, and a People section for
managing per-novel access.

Also includes prior in-flight changes from this branch (CLAUDE.md
compliance pass, dev-deploy docker-compose setup) that were
uncommitted when this feature work started.

src/Novelly.Api/Beats/BeatService.cs

@@ -5,11 +5,13 @@ using Novelly.Api.Common;
 using Novelly.Api.Common.Validation;
 using Novelly.Api.Data;
 using Novelly.Api.Tags;
+using Novelly.Api.Users;
 
 namespace Novelly.Api.Beats;
 
 public class BeatService(
     INovelDbContext db,
+    ProjectAccessService access,
     TagService tags,
     ILogger<BeatService> logger,
     IModelValidator<CreateBeatRequest> createValidator,
@@ -23,6 +25,8 @@ public class BeatService(
 
         logger.LogInformation("Listing beats for chapter {ChapterId}", chapterId);
 
+        await RequireChapterAccessAsync(chapterId, ProjectPermission.Read, ct);
+
         return await Query()
             .Where(b => b.ChapterId == chapterId)
             .OrderBy(b => b.SortOrder)
@@ -34,7 +38,15 @@ public class BeatService(
         Guard.Default(id, nameof(id));
 
         logger.LogInformation("Getting beat {BeatId}", id);
-        return await FindAsync(id, ct);
+
+        var beat = await FindAsync(id, ct);
+        if (beat is null)
+        {
+            return null;
+        }
+
+        await RequireBeatAccessAsync(beat, ProjectPermission.Read, ct);
+        return beat;
     }
 
     public async Task<IReadOnlyList<Beat>?> ListForCharacterAsync(
@@ -44,12 +56,15 @@ public class BeatService(
 
         logger.LogInformation("Listing beats for character {CharacterId}", characterId);
 
-        if (!await db.Characters.AnyAsync(c => c.Id == characterId, ct))
+        var characterProjectId = await db.Characters.Where(c => c.Id == characterId).Select(c => (Guid?)c.ProjectId).FirstOrDefaultAsync(ct);
+        if (characterProjectId is null)
         {
             logger.LogWarning("Character {CharacterId} not found", characterId);
             return null;
         }
 
+        await access.RequireAsync(characterProjectId.Value, ProjectPermission.Read, ct);
+
         var beats = await db.Beats
             .Include(b => b.Chapter)
             .Where(b => b.Characters.Any(c => c.Id == characterId))
@@ -78,6 +93,8 @@ public class BeatService(
             return null;
         }
 
+        await access.RequireAsync(chapter.ProjectId, ProjectPermission.CreateContent, ct);
+
         var beat = new Beat
         {
             ChapterId = chapterId,
@@ -124,6 +141,8 @@ public class BeatService(
             return null;
         }
 
+        await access.RequireAsync(chapter.ProjectId, ProjectPermission.Write, ct);
+
         beat.Title = Patch.Apply(beat.Title, request.Title) ?? beat.Title;
         beat.SortOrder = request.SortOrder ?? beat.SortOrder;
         beat.WhatHappened = Patch.Apply(beat.WhatHappened, request.WhatHappened);
@@ -156,6 +175,8 @@ public class BeatService(
             return false;
         }
 
+        await RequireBeatAccessAsync(beat, ProjectPermission.DeleteContent, ct);
+
         db.Beats.Remove(beat);
         await db.SaveChangesAsync(ct);
         return true;
@@ -170,6 +191,8 @@ public class BeatService(
 
         logger.LogInformation("Reordering {Count} beats for chapter {ChapterId}", request.BeatIds.Count, chapterId);
 
+        await RequireChapterAccessAsync(chapterId, ProjectPermission.Write, ct);
+
         var beats = await db.Beats.Where(b => b.ChapterId == chapterId).ToListAsync(ct);
 
         var missing = request.BeatIds.Where(id => beats.All(b => b.Id != id)).ToList();
@@ -212,6 +235,8 @@ public class BeatService(
             return null;
         }
 
+        await access.RequireAsync(chapter.ProjectId, ProjectPermission.Write, ct);
+
         var character = await db.Characters
             .FirstOrDefaultAsync(c => c.Id == request.CharacterId && c.ProjectId == chapter.ProjectId, ct);
         if (character is null)
@@ -279,6 +304,15 @@ public class BeatService(
         return next;
     }
 
+    private async Task RequireChapterAccessAsync(Guid chapterId, ProjectPermission permission, CancellationToken ct)
+    {
+        var projectId = await db.Chapters.Where(c => c.Id == chapterId).Select(c => c.ProjectId).FirstOrDefaultAsync(ct);
+        await access.RequireAsync(projectId, permission, ct);
+    }
+
+    private Task RequireBeatAccessAsync(Beat beat, ProjectPermission permission, CancellationToken ct) =>
+        RequireChapterAccessAsync(beat.ChapterId, permission, ct);
+
     private IQueryable<Beat> Query() =>
         db.Beats
             .Include(b => b.Characters)