feat: add user project management module

[grantf04]

@algora-pbc /claim #11

Closes #11

What this adds

Adds a self-contained user-project-management/ module for identity, researcher profiles, scientific project spaces, RBAC/object-level permissions, collaborator invitations, audit logs, reputation metrics, JSON APIs, tests, and a reviewer dashboard.

Requirement mapping

• Authentication and identity → implemented by authenticateIdentity, linked provider metadata, institutional SAML metadata, and MFA checks.
• Researcher profiles and ORCID sync → implemented by user records, syncOrcidProfile, affiliations, keywords, activity, and public/private profile modes.
• Citation and reputation metrics → implemented by computeReputation with explainable score breakdowns.
• Project spaces → implemented by createProjectSpace and demo project resources for documents, code, datasets, discussions, citations, funding, and tags.
• Permissions and access control → implemented by Owner/Admin/Contributor/Reviewer/Viewer roles plus object-scoped access checks.
• External collaborators and time-limited sharing → implemented by inviteCollaborator and expiring access rules.
• Project audit log → implemented by per-project auditLog entries for creation, invitations, and updates.

How to verify in under 5 minutes

cd user-project-management
npm test
npm start

Open http://localhost:4130 and verify the dashboard shows the project space, authenticated identity state, access matrix, and researcher profile/reputation cards.

Optional API smoke checks:

curl -s http://localhost:4130/api/dashboard
curl -s http://localhost:4130/api/auth/check
curl -s http://localhost:4130/api/access/check

Validation

Commands run:

• npm test - 4 tests passing
• curl -s http://localhost:4130/api/dashboard - returns project title, authenticated identity, and 3 access rules
• curl -s http://localhost:4130/api/access/check - returns granted edit_code access for user-mateo
• curl -i -s http://localhost:4130/package.json - returns 404 without crashing the server
• Browser demo verified at http://127.0.0.1:4130/: project, identity, access control, and profile panels render with 0 console errors
• ffprobe verified the committed demo video is 1280x760 and 8 seconds long

Demo

• Short demo video: user-project-management-demo.mp4
• Screenshot: dashboard.png
• Demo script: user-project-management/docs/demo-script.md

Scope

This PR is intentionally self-contained under user-project-management/ and avoids unrelated root-level changes except adding the module link to the root README.