Permission-aware workspace -> project -> one-level-subproject tree.

Returns exactly the projects GET /projects would show this caller (same scoping helper, same tenant-isolated db connection), annotated with an explicit relationship_scope label per row and an overall scope label ("workspace" for an owner/workspace-wide member, "project" for a project-scoped member) so the UI never has to guess what it is looking at. Nesting subprojects under their parent is left to the dashboard's existing, already-unit-tested flattenHierarchy helper (dashboard-subprojects.ts) — deliberately not re-implemented here, per the design note's reuse recommendation.