bmersereau fixes the silent failure in project sharing

Users were being denied access to projects that had been legitimately shared with them - not because of a permissions decision, but because the system was comparing email addresses with case sensitivity in some places and without it in others. Three different endpoints handled the same email field three different ways: one stored what the user typed, another lowercased on update, a third matched character-for-character on read. Whether sharing worked came down to which path your email took.

bmersereau pulled the normalisation logic out of the individual endpoints and into one place that every project route now calls through. Writes get lowercased, deduplicated, and stripped of empty entries; reads compare without caring about case. Eight unit tests pin down the edges.