feat: add project-scoped Copilot binding

[sabbour]

Part of #938.

Implement project-pinned Copilot authorization, Owner recheck, one-active-binding invariant, and registration validation.

Dependencies: #940.

[sabbour]

Claimed by @sabbour/Tank. Implementing project-scoped Copilot App binding endpoints on top of #957, with REST-level authorization/race/redaction coverage.