feat: 负责人下钻视图+项目负责人编辑管理+企微授权自助绑定

- 任务/项目负责人 union scope：任务中心分组视图、工作台项目进度卡、收录验证列
- 项目负责人可管理自己项目：编辑/删除项目、编辑任务、分配负责人、推送、项目内建任务；堵死转移归属/越权新建/任务迁移
- 只读依赖放开给已登录：inspect_feishu、wecom_list_internal_contacts
- 企微 OAuth 自助绑定：/api/wecom-bind（state 签名校验+登录态一致性+归属冲突检查），未绑定 banner 增加入口
- 工作台项目进度卡与未绑定 banner 排版修复
- 修 user-auth 判空分支被 Turbopack dev 折叠删除导致匿名请求 500

tests/project-service.test.mjs

@@ -190,8 +190,12 @@ function fakeProjectDb({ projects = [], tasks = [], partners = [] } = {}) {
     async all() {
       executed.push({ sql, params });
       if (/FROM projects p/.test(sql)) {
+        const ownerFiltered = /WHERE p\.owner_userid = \?/.test(sql);
+        const rows = ownerFiltered
+          ? projects.filter((item) => item.owner_userid === params[0])
+          : projects;
         return {
-          results: projects.map((item) => ({
+          results: rows.map((item) => ({
             ...item,
             task_count: tasks.filter((task) => task.project_id === item.id).length,
           })),
@@ -360,6 +364,29 @@ test("listProjects aggregates task counts and exposes mainChatId", async () => {
   assert.deepEqual(projects[0].mainGroupMemberIds, ["u1", "u2"]);
 });
 
+test("listProjects filters by project owner when ownerUserid given", async () => {
+  const db = fakeProjectDb({
+    projects: [
+      projectRow({ id: "proj-1", owner_userid: "owner-a" }),
+      projectRow({ id: "proj-2", owner_userid: "owner-b" }),
+      projectRow({ id: "proj-3", owner_userid: "" }),
+    ],
+  });
+  const mine = await listProjects(db, "owner-a");
+  assert.deepEqual(
+    mine.map((item) => item.id),
+    ["proj-1"],
+  );
+  const unbound = await listProjects(db, "");
+  assert.deepEqual(
+    unbound,
+    [],
+    "已登录未绑定企微的空范围不应漏出无主项目",
+  );
+  const all = await listProjects(db);
+  assert.equal(all.length, 3);
+});
+
 test("getProjectDetail returns tasks with owner and mainChat members", async () => {
   const db = fakeProjectDb({
     projects: [