Open a TaskStream board when a project is created through the API

`taskstream: true` on POST /v1/projects also creates the project in
TaskStream, public, as the caller (their Pireon token is passed on), and
the answer carries `taskstream_key` and `taskstream_url`. The key is
`taskstream_key` or one made from the default-language slug.

The board is opened before the project is saved: if TaskStream refuses
it, nothing is created here and the reason comes back as a validation
error (502 when TaskStream does not answer). Machine tokens need the
server's own TASKSTREAM_TOKEN. Updates ignore the flag, and duplicates do
not inherit the link.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Http/Controllers/Api/V1/ProjectController.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Http\Controllers\Api\V1;
 
+use App\Actions\Projects\OpenInTaskStream;
 use App\Http\Controllers\Controller;
 use App\Http\Requests\Api\V1\ProjectRequest;
 use App\Http\Resources\ProjectResource;
@@ -45,11 +46,21 @@ class ProjectController extends Controller
         return ProjectResource::collection($projects);
     }
 
-    public function store(ProjectRequest $request): JsonResponse
+    /**
+     * With `taskstream: true`, the project's board is opened in TaskStream
+     * first; if that fails, nothing is created here either.
+     */
+    public function store(ProjectRequest $request, OpenInTaskStream $openInTaskStream): JsonResponse
     {
         $this->authorize('create', Project::class);
 
-        $project = $this->save(new Project, $request);
+        $project = $this->fill(new Project, $request);
+
+        if ($request->boolean('taskstream')) {
+            $openInTaskStream->handle($project, $request->user(), $request->bearerToken(), $request->validated('taskstream_key'));
+        }
+
+        $project = $this->persist($project, $request);
 
         return ProjectResource::make($project)->response()->setStatusCode(201);
     }
@@ -65,7 +76,7 @@ class ProjectController extends Controller
     {
         $this->authorize('update', $project);
 
-        return ProjectResource::make($this->save($project, $request));
+        return ProjectResource::make($this->persist($this->fill($project, $request), $request));
     }
 
     public function destroy(Project $project): JsonResponse
@@ -86,20 +97,24 @@ class ProjectController extends Controller
         return ProjectResource::make($project->load(self::WITH));
     }
 
+    protected function fill(Project $project, ProjectRequest $request): Project
+    {
+        return $project->fill(TranslatablePayload::merge(
+            $project,
+            collect($request->validated())->except(['technology_ids', 'service_ids', 'members', 'taskstream', 'taskstream_key'])->all(),
+            $project->translatable,
+        ));
+    }
+
     /**
      * The record and its relations in one transaction: a project that saved
      * but lost its team halfway would be worse than one that did not save.
      */
-    protected function save(Project $project, ProjectRequest $request): Project
+    protected function persist(Project $project, ProjectRequest $request): Project
     {
         $data = $request->validated();
 
         DB::transaction(function () use ($project, $data): void {
-            $project->fill(TranslatablePayload::merge(
-                $project,
-                collect($data)->except(['technology_ids', 'service_ids', 'members'])->all(),
-                $project->translatable,
-            ));
             $project->save();
 
             if (array_key_exists('technology_ids', $data)) {