Open a TaskStream board when a project is created through the API

`taskstream: true` on POST /v1/projects also creates the project in
TaskStream, public, as the caller (their Pireon token is passed on), and
the answer carries `taskstream_key` and `taskstream_url`. The key is
`taskstream_key` or one made from the default-language slug.

The board is opened before the project is saved: if TaskStream refuses
it, nothing is created here and the reason comes back as a validation
error (502 when TaskStream does not answer). Machine tokens need the
server's own TASKSTREAM_TOKEN. Updates ignore the flag, and duplicates do
not inherit the link.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Http/Requests/Api/V1/ProjectRequest.php

@@ -19,6 +19,9 @@ use Illuminate\Validation\Validator;
  *
  * Relations travel as ids and are replaced whole when sent: `technology_ids`,
  * `service_ids`, and `members` with each one's role on the project.
+ *
+ * `taskstream` (on creation only) opens a public board in TaskStream for the
+ * project, keyed `taskstream_key` or one derived from the slug.
  */
 class ProjectRequest extends FormRequest
 {
@@ -74,6 +77,11 @@ class ProjectRequest extends FormRequest
             'members' => ['sometimes', 'array'],
             'members.*.id' => ['required', 'integer', 'distinct', Rule::exists('members', 'id')->whereNull('deleted_at')],
             'members.*.role' => ['nullable', 'string', 'max:120'],
+
+            // Only when creating; a client PATCHing back what it read sends
+            // the key it got, which is ignored rather than refused.
+            'taskstream' => [$creating ? 'sometimes' : 'exclude', 'boolean'],
+            'taskstream_key' => [$creating ? 'sometimes' : 'exclude', 'nullable', 'string', 'regex:/^[A-Za-z][A-Za-z0-9]{1,9}$/'],
         ];
     }