Manage projects, members and services through the API

/api/v1/projects, /members and /services: create, list, show, update,
delete and restore, with the panel's own rules — so the MCP server can
load the collective's work, people and offer without anyone retyping
them into forms. The MCP server picks the tools up from openapi.yaml.

- Relations travel as ids and are replaced whole when sent, left alone
  when not: a project's technology_ids, service_ids and members with
  each one's role; a member's technology_ids; a service's
  technology_ids and project_ids. Record and relations are saved in
  one transaction.
- Publishing stays a permission of its own. Without projects.publish
  or services.publish, published_at, unpublish_at and is_published are
  refused — the fields the panel disables for the same people.
- MemberPolicy still lets someone edit their own profile.
- Uploads accept `for: projects` and `for: members`, landing where the
  panel's own upload fields put them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Http/Controllers/Api/V1/MemberController.php

@@ -0,0 +1,103 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Api\V1\MemberRequest;
+use App\Http\Resources\MemberResource;
+use App\Models\Member;
+use App\Support\TranslatablePayload;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * The people in the collective, as the panel edits them. MemberPolicy lets
+ * someone edit their own profile without `members.update`, as in the panel.
+ */
+class MemberController extends Controller
+{
+    protected const WITH = ['avatarMedia', 'technologies', 'projects'];
+
+    /**
+     * Filters: search (name), is_public, trashed.
+     */
+    public function index(Request $request): AnonymousResourceCollection
+    {
+        $this->authorize('viewAny', Member::class);
+
+        $members = Member::query()
+            ->with(self::WITH)
+            ->when($request->filled('search'), fn ($q) => $q->where('name', 'like', '%'.$request->string('search').'%'))
+            ->when($request->has('is_public'), fn ($q) => $q->where('is_public', $request->boolean('is_public')))
+            ->when($request->boolean('trashed'), fn ($q) => $q->onlyTrashed())
+            ->orderBy('position')
+            ->orderBy('name')
+            ->paginate(perPage: min($request->integer('per_page', 25), 100))
+            ->withQueryString();
+
+        return MemberResource::collection($members);
+    }
+
+    public function store(MemberRequest $request): JsonResponse
+    {
+        $this->authorize('create', Member::class);
+
+        return MemberResource::make($this->save(new Member, $request))->response()->setStatusCode(201);
+    }
+
+    public function show(Member $member): MemberResource
+    {
+        $this->authorize('view', $member);
+
+        return MemberResource::make($member->load(self::WITH));
+    }
+
+    public function update(MemberRequest $request, Member $member): MemberResource
+    {
+        $this->authorize('update', $member);
+
+        return MemberResource::make($this->save($member, $request));
+    }
+
+    public function destroy(Member $member): JsonResponse
+    {
+        $this->authorize('delete', $member);
+
+        $member->delete();
+
+        return response()->json(status: 204);
+    }
+
+    public function restore(Member $member): MemberResource
+    {
+        $this->authorize('restore', $member);
+
+        $member->restore();
+
+        return MemberResource::make($member->load(self::WITH));
+    }
+
+    protected function save(Member $member, MemberRequest $request): Member
+    {
+        $data = $request->validated();
+
+        DB::transaction(function () use ($member, $data): void {
+            $member->fill(TranslatablePayload::merge(
+                $member,
+                collect($data)->except('technology_ids')->all(),
+                $member->translatable,
+            ));
+            $member->save();
+
+            if (array_key_exists('technology_ids', $data)) {
+                $member->technologies()->sync($data['technology_ids']);
+            }
+        });
+
+        return $member->load(self::WITH);
+    }
+}