Add project data residency transfer guard

[vondutchi]

/claim #11

Summary

• Add project-data-residency-transfer-guard/, a distinct User & Project Management slice for data-residency and institutional transfer checks before project access or sharing changes are approved.
• Evaluate project visibility, dataset classification, home/destination regions, collaborator institution, DPA/DUA/IRB state, export embargoes, external partner policy, and data-steward approval evidence.
• Emit deterministic reviewer artifacts in JSON, Markdown, SVG, and MP4 form using synthetic data only.

Scope Boundaries

This is synthetic demo data only. It does not call identity providers, OAuth, SAML, ORCID, production access-control systems, external APIs, live projects, private user data, credentials, tokens, payment systems, or payout systems.

This scope is intentionally separate from existing #11 slices such as RBAC/workspace ledgers, privacy review, member lifecycle/offboarding, institutional recertification, anonymous-review escrow, identity merge/export, data-room consent, profile sync, archive handoff, access-audit anomaly, role delegation, invitation/MFA, funding attribution, service-token governance, deletion/erasure, break-glass, visibility transition, provisioning baseline, object-permission inheritance, reputation anomaly, session step-up, and collaborator COI guards.

Demo

• project-data-residency-transfer-guard/reports/demo.mp4

Validation

• node project-data-residency-transfer-guard/test.js
• node project-data-residency-transfer-guard/demo.js
• node project-data-residency-transfer-guard/render-video.js
• ffprobe confirmed H.264, 960x540, 5 seconds, 120 frames for the demo MP4.
• node --check project-data-residency-transfer-guard/index.js
• node --check project-data-residency-transfer-guard/sample-data.js
• node --check project-data-residency-transfer-guard/test.js
• node --check project-data-residency-transfer-guard/demo.js
• node --check project-data-residency-transfer-guard/render-video.js
• git diff --cached --check

No payout details, secrets, tokens, cookies, or private account information are included in this PR.