feat: 负责人下钻视图+项目负责人编辑管理+企微授权自助绑定

- 任务/项目负责人 union scope：任务中心分组视图、工作台项目进度卡、收录验证列
- 项目负责人可管理自己项目：编辑/删除项目、编辑任务、分配负责人、推送、项目内建任务；堵死转移归属/越权新建/任务迁移
- 只读依赖放开给已登录：inspect_feishu、wecom_list_internal_contacts
- 企微 OAuth 自助绑定：/api/wecom-bind（state 签名校验+登录态一致性+归属冲突检查），未绑定 banner 增加入口
- 工作台项目进度卡与未绑定 banner 排版修复
- 修 user-auth 判空分支被 Turbopack dev 折叠删除导致匿名请求 500

lib/user-auth.ts

@@ -267,7 +267,9 @@ export async function getUserFromSessionToken(token: string): Promise<AuthUser |
   };
 }
 
-export async function getUserFromCookieHeader(cookieHeader: string | null) {
+export async function getUserFromCookieHeader(
+  cookieHeader: string | null,
+): Promise<AuthUser | null> {
   return getUserFromSessionToken(sessionCookieFromHeader(cookieHeader));
 }
 
@@ -277,12 +279,18 @@ function hasInternalToken(request: Request) {
   return Boolean(expected && received && safeEqual(expected, received));
 }
 
+// Turbopack dev 会把 `!user` 误判为编译期常量并删掉判空分支，这里用不透明函数调用兜住
+function isNullish(value: unknown): value is null | undefined {
+  return value === null || value === undefined;
+}
+
 export async function getRequestPrincipal(
   request: Request,
 ): Promise<RequestPrincipal | null> {
   if (hasInternalToken(request)) return { kind: "internal" };
   const user = await getUserFromCookieHeader(request.headers.get("cookie"));
-  return user ? { kind: "user", user } : null;
+  if (isNullish(user)) return null;
+  return { kind: "user", user };
 }
 
 export async function isAppRequest(request: Request) {