Create a project in a workspace the authenticated user can write to.

Requires MEMBER role or higher in the workspace (the write service decides). Idempotent on the project name within the workspace.

Args: request (Request): Incoming request (rate-limit plumbing). response (Response): Outgoing response (rate-limit plumbing). auth (AccountStampedAuth): Account-scope user auth (session token or CLI access JWT); its resolved user_id becomes the actor. payload (CreateProjectRequest): The project to create. _live (None): Write-path liveness gate (blocks a revoked JWT session).

Returns: CreateProjectResponse: The created (or matched) project.