fix(api): typed OpenAPI query params and not-found messages that hide private projects

- Query DTO properties with a default value (limit, offset, days, perColumn,
  assignedToMe, search, archived, requiresReason, force) were documented as
  `object` in openapi.json, which broke generated clients. They now declare
  their type explicitly.
- Reading a private project, ticket, release or its comments without access
  answered "Project <internal id> not found", confirming the project exists.
  ReadAccess now reports what the caller asked for (e2e covered).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/identity/presenters/src/lib/http/users.controller.ts

@@ -48,13 +48,17 @@ export class MeDto extends UserDto {
 }
 
 export class UserSearchQueryDto {
-  @ApiPropertyOptional({ description: 'Name or email', default: '' })
+  @ApiPropertyOptional({
+    type: String,
+    description: 'Name or email',
+    default: '',
+  })
   @IsOptional()
   @IsString()
   @MaxLength(100)
   search = '';
 
-  @ApiPropertyOptional({ default: 20, minimum: 1, maximum: 100 })
+  @ApiPropertyOptional({ type: Number, default: 20, minimum: 1, maximum: 100 })
   @IsOptional()
   @Type(() => Number)
   @IsInt()