ryanmcdonough plugs a chat-creation authorization hole

The original Mike codebase had a quiet flaw in how it created chats: when a user started a new chat tied to a project, the backend trusted whatever project ID the request handed it, without checking the user was actually allowed into that project. An authenticated user could effectively park their chats inside someone else's matter.

ryanmcdonough's fork adds the missing check, using the same access helper the rest of the codebase already relies on for project-scoped routes. If you don't own the project or haven't been shared into it, the request gets a not-found response and no chat row is written. Upstream still has the gap.