feat: REST API for repository project boards

[hanism01]

Summary

Gitea has no REST API for repository project boards. This makes it impossible to manage projects programmatically or integrate them with external tooling (e.g. MCP servers, CI pipelines, bots).

Proposed endpoints

These endpoints were originally proposed in #36008 by @SupenBysz:

• GET /repos/{owner}/{repo}/projects — list projects
• POST /repos/{owner}/{repo}/projects — create project
• GET /repos/{owner}/{repo}/projects/{id} — get project
• PATCH /repos/{owner}/{repo}/projects/{id} — update project
• DELETE /repos/{owner}/{repo}/projects/{id} — delete project
• GET /repos/{owner}/{repo}/projects/{id}/columns — list columns (paginated)
• POST /repos/{owner}/{repo}/projects/{id}/columns — create column
• PATCH /repos/{owner}/{repo}/projects/columns/{id} — update column
• DELETE /repos/{owner}/{repo}/projects/columns/{id} — delete column
• POST /repos/{owner}/{repo}/projects/columns/{id}/issues — assign issue to column

Relationship to #36008

PR #36008 implemented all of the above but has been idle since December 2025 with unaddressed review feedback from @lunny. This issue tracks a follow-up implementation that addresses those review concerns:

1. Duplicate permission checks removed (route group already wraps with reqRepoReader/reqRepoWriter)
2. AddOrUpdateIssueToColumn replaced with IssueAssignOrRemoveProject (adds transaction safety, audit comment, cross-repo ownership guard)
3. ListProjectColumns pagination implemented correctly per API contribution guidelines (DB-level, with X-Total-Count header)

AI disclosure: This issue and the associated implementation are being prepared with the assistance of Claude Sonnet 4.5. Per the AI contribution policy, the contributor (hanism01) owns the review dialogue and has manually tested all endpoints against a local Gitea instance built from source.

[lunny]

Related to #35921, #14299, #31769