Fix critical cloud tenant isolation boundaries

[Bl3f]

Summary

• return an explicit safe DTO from project.getCurrent
• block project and organization admin password resets in cloud and hide those actions in cloud UI
• canonicalize context file paths to reject symlink escapes
• authenticate FastAPI internal routes, enforce read-only SQL defense-in-depth, and bind direct FastAPI startup to localhost

Validation

• repository pre-commit checks pass: TypeScript/ESLint, Prettier, migration checks, ty, and Ruff
• focused backend regression tests: 13 passed
• focused FastAPI tests: 14 passed, 2 optional BigQuery tests deselected

  

[github-actions]

🚀 Preview Deployment

URL	https://pr-1229-21b1426.preview.getnao.io
Commit	21b1426

⚠️ No LLM API keys configured - you'll see the API key setup flow when trying to chat.

---

_{Preview will be automatically removed when this PR is closed.}