Read-only, repeatable launch matrix across every in-scope project (ba31dedf).

Same auth/hostname-resolution contract as /tunnel/diagnostics/{tenant_id} (tenant_id in the path is documentary only); joins that diagnostic snapshot with this request's project set — see :func:build_launch_matrix for the full field-by-field contract. A DB error while listing projects degrades to an empty project set (diagnostics-only response) rather than failing the request — matches get_tunnel_filesystem_roots's existing best-effort convention for this same tenant/project join.

ece2ac0a — hosted callers must be authenticated. The _db call below is wrapped in a broad except (best-effort project listing), so it cannot be relied on to refuse an anonymous caller; refuse explicitly first.