Resolve and return the merged profile for a project across every applicable layer — hosted_default -> workspace -> user -> project -> session. Mirrors the get_effective_profile MCP tool. This is the one project-anchored route in this module — see the module docstring.

RT-TI-005 (wave 2) — project_id is vetted by the middleware, but session_id merges that session's layer into the result and db.get_effective_profile never checks the session belongs to the project. A project-scoped caller therefore gets a 403 for a session of any other project (or an unknown one); unscoped callers are unchanged.