feat(chat): project-scoped chat — mcpctl chat --project <name>

Chat directly with a Project (no Agent needed): its Prompts become the system
context, its MCP-server tools are callable, its llmProvider/llmModel drive the
LLM, and (opt-in) the model can read secret values. History is saved inside the
project, attributed per user, resumable, and deletable (RBAC-permitting) — "use
it like Claude, scoped to the project".

Backend (reuses the agent-chat orchestrator):
- ChatThread is now agent-XOR-project (schema + migration + CHECK constraint);
  new listThreadsByProject / deleteThread on the repo.
- ChatService: prepareProjectContext (project prompt + Prompts by priority,
  llm from llmProvider with llmModel override, project tools), shared
  runChatLoop/runChatStreamLoop, project thread CRUD with owner enforcement
  (404-not-403 on foreign threads), admin-override delete.
- Gated get_secret virtual tool: offered only with --allow-secrets AND the
  caller's view:secrets; resolves via SecretService, never routes to a server.
- routes/project-chat.ts (chat SSE+non-stream, threads create/list/delete);
  RBAC run:projects:<name>.

CLI:
- `mcpctl chat --project <name>` (+ --allow-secrets), one-shot/REPL/resume.
- REPL /threads, /resume <id>, /delete <id>; project-aware header + /tools.
- `mcpctl get threads --project <name>`, `mcpctl delete thread <id> --project`.
- completions regenerated (--project completes project names).

Tests: 8 new project-chat unit tests; full mcpd (945) + CLI (508) green;
schema validated against Postgres. Docs: docs/chat.md "Project chat" section.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/chat.md

@@ -17,6 +17,49 @@ Streaming is on by default. Text deltas land on stdout as they arrive; tool
 calls and tool results print to stderr in dim brackets so the chat output
 stays clean.
 
+## Project chat
+
+Chat directly with a **project** — no Agent needed. The session sees the
+project's Prompts as system context, can call every tool from the project's
+attached MCP servers, and uses the project's own LLM (`llmProvider`, with
+`llmModel` as an optional served-model override).
+
+```bash
+mcpctl chat --project sre                 # REPL scoped to project "sre"
+mcpctl chat --project sre -m "what alerts fired overnight?"
+mcpctl chat --project sre --thread <id>   # resume a past conversation
+```
+
+- **Prompts + tools** come from the project and stay current — anything you
+  add to the project later shows up automatically in the next turn.
+- **LLM:** set it once with `mcpctl patch project sre llmProvider=<llm-name>`
+  (and optionally `llmModel=<served-model>`). Chat errors clearly if unset.
+- **History is saved inside the project**, attributed to you. List and resume:
+  ```bash
+  mcpctl get threads --project sre         # your threads for this project
+  mcpctl chat --project sre --thread <id>
+  ```
+  Delete one you own (admins with `delete:projects` can delete anyone's):
+  ```bash
+  mcpctl delete thread <id> --project sre
+  ```
+
+### Reading secrets (`--allow-secrets`)
+
+By default the model cannot read secret values — it only benefits from them
+indirectly (the project's tools run authenticated). Opt in with
+`--allow-secrets` to expose a `get_secret` tool the model can call:
+
+```bash
+mcpctl chat --project sre --allow-secrets
+```
+
+This is gated: it requires the flag **and** your `view:secrets` permission,
+and it is off by default. Secret values the model reads land in the chat
+context and thread history, so use it deliberately.
+
+RBAC: project chat and its threads route through `run:projects:<name>`.
+
 ## Per-call flags
 
 All optional. They override the agent's `defaultParams` for this session