feat(server): 工程骨架后端——上传 → 解析 → 清单最小链路

- core：配置（prod 拒绝默认密钥 / dev 短信 / 假模型）、租户事务 + 行级安全策略、
  problem+json 错误码、信封加密与签名下载、对象存储、事务内入队、Valkey stream 事件流、权限点
- identity：手机号 HMAC 存储、注册、登录（挤下线需确认，API3）、服务端会话
- billing：额度流水只追加，预扣 / 结算 / 退回，一笔预扣只有一个结局
- document：分片上传、按文件头识别格式、Gotenberg 转换、文字层与稳定句子编号
- checklist：标注规则识别、模型抽取、三道校验、标注类条款规则兜底、重跑对齐
- ai：提示词注册表（extract.substantive v1 来自 S4 v2）、假模型、OpenAI 兼容供应商、ai_call 流水
- 迁移：data-model 基线、套餐、Procrastinate、会话状态函数
- 测试 30 个：租户隔离、额度、失败退回、对象加密、契约一致性
- Compose（含 migrate）、镜像、CI

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/src/bid_doctor/project/api.py

@@ -0,0 +1,37 @@
+from __future__ import annotations
+
+from typing import Any
+from uuid import UUID
+
+from fastapi import APIRouter, Query
+from pydantic import BaseModel, Field
+
+from bid_doctor.core.db import tenant_tx
+from bid_doctor.identity.deps import Ctx
+from bid_doctor.project import service, workbench
+
+router = APIRouter(tags=["projects"])
+
+
+class ProjectIn(BaseModel):
+    name: str | None = Field(default=None, max_length=200)
+
+
+@router.get("/projects")
+async def list_projects(ctx: Ctx, limit: int = Query(default=20, ge=1, le=100)) -> dict[str, Any]:
+    # TODO(工作台筛选)：status / deadline / q / 游标分页，按 openapi.yaml 补齐
+    async with tenant_tx(ctx) as s:
+        return {"items": await workbench.rows(s, ctx, limit), "next_cursor": None}
+
+
+@router.post("/projects", status_code=201)
+async def create_project(body: ProjectIn, ctx: Ctx) -> dict[str, Any]:
+    async with tenant_tx(ctx) as s:
+        p = await service.create(s, ctx, body.name)
+        return await workbench.detail(s, ctx, p.id)
+
+
+@router.get("/projects/{project_id}")
+async def get_project(project_id: UUID, ctx: Ctx) -> dict[str, Any]:
+    async with tenant_tx(ctx) as s:
+        return await workbench.detail(s, ctx, project_id)