Manage projects, members and services through the API

/api/v1/projects, /members and /services: create, list, show, update,
delete and restore, with the panel's own rules — so the MCP server can
load the collective's work, people and offer without anyone retyping
them into forms. The MCP server picks the tools up from openapi.yaml.

- Relations travel as ids and are replaced whole when sent, left alone
  when not: a project's technology_ids, service_ids and members with
  each one's role; a member's technology_ids; a service's
  technology_ids and project_ids. Record and relations are saved in
  one transaction.
- Publishing stays a permission of its own. Without projects.publish
  or services.publish, published_at, unpublish_at and is_published are
  refused — the fields the panel disables for the same people.
- MemberPolicy still lets someone edit their own profile.
- Uploads accept `for: projects` and `for: members`, landing where the
  panel's own upload fields put them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

routes/api.php

@@ -13,8 +13,11 @@ use App\Http\Controllers\Api\PublicApi\V1\TelemetryController;
 use App\Http\Controllers\Api\V1\CategoryController;
 use App\Http\Controllers\Api\V1\MeController;
 use App\Http\Controllers\Api\V1\MediaController;
+use App\Http\Controllers\Api\V1\MemberController;
 use App\Http\Controllers\Api\V1\PageController;
+use App\Http\Controllers\Api\V1\ProjectController;
 use App\Http\Controllers\Api\V1\RoleController;
+use App\Http\Controllers\Api\V1\ServiceController;
 use App\Http\Controllers\Api\V1\TechnologyController;
 use App\Http\Controllers\Api\V1\TokenController;
 use App\Http\Controllers\Api\V1\UserController;
@@ -169,6 +172,21 @@ Route::prefix('v1')->name('api.v1.')->group(function () {
 
         Route::apiResource('technologies', TechnologyController::class);
 
+        // The collective's work, people and offer. Soft-deleted, so each can
+        // be brought back as a page can.
+        foreach ([
+            'projects' => ProjectController::class,
+            'members' => MemberController::class,
+            'services' => ServiceController::class,
+        ] as $resource => $controller) {
+            $parameter = str($resource)->singular()->toString();
+
+            Route::apiResource($resource, $controller);
+            Route::post("{$resource}/{{$parameter}}/restore", [$controller, 'restore'])
+                ->withTrashed()
+                ->name("{$resource}.restore");
+        }
+
         // Upload only: the file is then referenced from a record by its path.
         Route::post('media', [MediaController::class, 'store'])->name('media.store');