Project deletion cascaded through saved keywords, rank tracking, and
audits, and the endpoint had no role check (Codex security finding).
Instead of gating a destructive delete, remove it: archiving stamps
archived_at, hides the project everywhere (lists, project context,
rank-check cron), and preserves all data. Archived projects can be
restored from the Manage projects page.
The restore input is named archivedProjectId because the global
ensureUserMiddleware resolves any projectId in input data against
active projects and would 404 before the handler runs.
