feat(t-paliad-149) PR2 step 1/3: backend — migration 061 + CardLayoutService + CardsPreview

Migration 061 (paliad.user_card_layouts): per-user named card layouts.
- Partial unique index on (user_id) WHERE is_default=true keeps "at most
  one default per user" honest at the DB level.
- UNIQUE (user_id, name) so the layout dropdown can use names as stable
  labels.
- RLS owner-only (mirrors paliad.user_views from t-144).

LayoutSpec (internal/services/layout_spec.go): structured JSON validator
with KnownFactKeys registry (11 fact keys: title-row, type-chip, status-
chip, client-matter, parent-path, deadline-counts, next-events, recent-
verlauf, team-chips, reference, last-activity-at). Validator enforces:
- title-row must be the first VISIBLE fact (always-on, structural)
- no duplicate keys
- count ∈ [1, 5] only on next-events / recent-verlauf
- density ∈ {compact, roomy} (CardDensity, distinct from t-144's
  ListDensity which only ranges over comfortable/compact)
- grid_columns ∈ {auto, 2, 3, 4}

DefaultLayoutSpec returns the m-locked rich content set per design §5b.4
(9 facts, roomy density, auto grid, leaf-ish projects only).

CardLayoutService: CRUD with auto-seed (GetDefault creates "Standard"
on first call) + tx-flip-default (setting is_default=true on B clears
A in the same transaction) + ErrUserCardLayoutDefaultGate (deleting
the active default returns 409). isPgUniqueViolation maps the partial
unique index conflict to ErrUserCardLayoutNameTaken.

ProjectService.CardsPreview: per-project event rollups for the Cards view.
4 source SQLs with ROW_NUMBER() OVER PARTITION BY project_id (top 3 each
for upcoming deadlines, upcoming appointments, recent project_events) +
team-chips JOIN. Single round-trip per source, visibility-gated. Returns
map[uuid.UUID]*ProjectCardPreview with last_activity_at computed across
all sources for the orchestrator's card-grid sort.

Handlers: 5 /api/user-card-layouts/* endpoints (GET list, POST create,
PATCH update, DELETE, POST set-default) + GET /api/projects/cards-preview
(narrowable via ?ids=<csv>).

Wired in handlers.go (Services struct + dbServices struct) and
cmd/server/main.go. ErrUserCardLayoutNameTaken / NotFound / DefaultGate
mapped to 409 / 404 / 409 respectively.

Tests:
- layout_spec_test.go (8 cases, pure-Go): valid default, empty rejection,
  title-row-first invariant, hidden leading allowed, dup-key rejection,
  unknown-key rejection, count-bounds + count-on-wrong-key, density/grid
  enum, ParseLayoutSpec round-trip.
- card_layout_service_test.go (6 cases, live-DB): GetDefault auto-seeds
  + idempotent, first Create auto-becomes default, SetDefault clears
  prior, Delete refuses active default, Delete non-default works,
  duplicate name rejected, Update round-trips layout JSON.

go build / vet / test (short) clean.

Design: docs/design-projects-page-2026-05-07.md §5b.3, §5b.5, §8.2.

internal/handlers/projects.go

@@ -48,6 +48,7 @@ type dbServices struct {
 	userView       *services.UserViewService
 	broadcast      *services.BroadcastService
 	pin            *services.PinService
+	cardLayout     *services.CardLayoutService
 }
 
 var dbSvc *dbServices
@@ -321,6 +322,48 @@ func parseBoolQuery(v string, def bool) bool {
 	}
 }
 
+// GET /api/projects/cards-preview — per-project event rollups for the
+// Cards view. Returns a flat list of {project_id, next_events,
+// recent_verlauf, team_initials, team_count, last_activity_at} for every
+// project the user can see (or the subset given via ?ids=<csv-of-uuids>).
+//
+// Visibility-scoped server-side. Caller (Cards mode) lazy-fetches batches
+// via IntersectionObserver.
+func handleProjectsCardsPreview(w http.ResponseWriter, r *http.Request) {
+	if !requireDB(w) {
+		return
+	}
+	uid, ok := requireUser(w, r)
+	if !ok {
+		return
+	}
+
+	var ids []uuid.UUID
+	if raw := r.URL.Query().Get("ids"); raw != "" {
+		for _, s := range splitCSV(raw) {
+			u, err := uuid.Parse(s)
+			if err != nil {
+				writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid uuid in ?ids"})
+				return
+			}
+			ids = append(ids, u)
+		}
+	}
+
+	previews, err := dbSvc.projects.CardsPreview(r.Context(), uid, ids)
+	if err != nil {
+		writeServiceError(w, err)
+		return
+	}
+	// Flat array for JSON; the map order is irrelevant to the client (it
+	// keys on project_id when stitching to its tree-id list).
+	out := make([]*services.ProjectCardPreview, 0, len(previews))
+	for _, p := range previews {
+		out = append(out, p)
+	}
+	writeJSON(w, http.StatusOK, out)
+}
+
 // splitCSV splits a comma-separated query value into trimmed non-empty
 // tokens. Empty input → nil so callers can branch on `len(out) > 0`.
 func splitCSV(s string) []string {