Create Project

Create a project OWNED by the authenticated account (owner derived from the session, never the body). The portal gatekeeper enforces the per-tier project count before calling this.

Refuses a banned owner (core#633 adversarial review round 6, 2026-09-26): belt-and-suspenders only — a project minted here still cannot escape the owner's ban (SubscriptionGuardMiddleware/vault_routes resolve the ban via the owner regardless of when the project was created), but there is no reason to let a banned owner keep provisioning new buckets either.