feat(server): add project RBAC and guarded workflows

app/infra/db/metadb/repositories/metadata_repository.py

@@ -211,6 +211,7 @@ class MetadataRepository:
         gs_workspace: str,
         map_extent: dict | None,
         status: str,
+        creator_user_id: UUID | None = None,
     ) -> models.Project:
         project = models.Project(
             id=uuid4(),
@@ -224,6 +225,15 @@ class MetadataRepository:
             updated_at=_utcnow(),
         )
         self.session.add(project)
+        if creator_user_id is not None:
+            self.session.add(
+                models.UserProjectMembership(
+                    id=uuid4(),
+                    user_id=creator_user_id,
+                    project_id=project.id,
+                    project_role="member",
+                )
+            )
         await self.session.commit()
         await self.session.refresh(project)
         return project
@@ -483,7 +493,7 @@ class MetadataRepository:
                 gs_workspace=project.gs_workspace,
                 map_extent=project.map_extent,
                 status=project.status,
-                project_role="owner",
+                project_role="member",
             )
             for project in result.scalars().all()
         ]