fix(apiserver): enforce self_ug job scopes and accept project filters (bug-1934, bug-1935)

bug-1934: every job-permission check read a single scope and compared it
only with "self", so a job:view or job:control grant scoped to self_ug acted
like "all" (list, get by ID, control), and self + self_ug collapsed to self.
userJobScope() now collects all of a user's grants of a job permission
before deduplication and adds them up (all; self; self_ug = the user and
everyone sharing a user group). The job list appends a submit_user filter
for narrower scopes, get-by-ID keeps covered rows in a new slice (removing
from the ranged slice skipped rows) and answers 403, both control paths
and job output check the owner against the scope. User groups now reach
the apiserver: the config push converts cluster_config_t.ugroups and
OnUserGroupsUpdated() replaces the new store (nested groups, all,
exclusions). The default basic_user now also sees its user-group mates'
jobs, as its configuration says.

bug-1935: project_name and license_project are accepted job filters, so
xcecli jobs list -P works.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.wolf/bugs/bug-1935.md

@@ -10,7 +10,7 @@ last_seen: "2026-10-10T04:31:27Z"
 occurrences: 1
 files: ["src/frontend/apiserver/models/jobs.go", "src/frontend/apiserver/controllers/jobs.go", "src/frontend/xcecli/filters/job_filter.go"]
 tags: ["apiserver", "xcecli", "filter", "project"]
-related: []
+related: ["bug-1934"]
 ---
 
 # bug-1935: xcecli jobs list -P <project> fails: apiserver rejects project_name filter (unsupported filter)
@@ -36,6 +36,9 @@ project is `eng`.
 project. No data is affected.
 **Found by:** review, during `/kiro-spec-requirements project-config`
 (2026-10-10); `project-config` Requirement 7.5 needs this filter.
+UPDATE (2026-10-10): confirmed by `TestJobHandler_ProjectFilters`
+(`src/frontend/apiserver/controllers/job_scope_test.go`) before the fix:
+`status = 400 ... unsupported filter: project_name`.
 
 ## Environment
 - OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
@@ -55,15 +58,28 @@ project. No data is affected.
 - Evidence: the code lines quoted in Description; no logs.
 
 ## Root cause
-TODO: required for fixed/partial
-
+`JOB_SUPPORT_FILTERS` (`src/frontend/apiserver/models/jobs.go`) had
+`project_name` and `license_project` commented out, and
+`validateJobQueryFilters()` (`controllers/jobs.go`) rejects every field not on
+that list, while `xcecli` (`filters/job_filter.go:108-113`) sends exactly
+those fields for `-P` and the license-project option. The job store already
+carries both fields (`JobInfo.ProjectName`, `LicenseProject`). Since:
+pre-existing, origin unknown.
 ## Fix
-TODO: required for fixed/partial
-
+`models/jobs.go`: `project_name` and `license_project` are now in
+`JOB_SUPPORT_FILTERS`. No other change was needed: the store query filters
+by the JSON field name. `ARRAY_JOB_SUPPORT_FILTERS` (array statistics) is
+unchanged.
 ## Verification
-- Test: TODO: name + file; RED before the fix, GREEN after
-- Suites: TODO: suite results and build profile
-- Live: TODO: soak/deploy run, or n/a and why
+- Test: `TestJobHandler_ProjectFilters`
+  (`src/frontend/apiserver/controllers/job_scope_test.go`): RED before (400
+  unsupported filter), GREEN after (`{project_name:eq:eng}` and
+  `{license_project:eq:lic2}` select only the matching job).
+- Suites: same run as bug-1934: apiserver and xcecli Go tests ok, meson
+  `apiserver` suite 1/1 OK, asan, 2026-10-10.
+- Live: n/a: the change is a filter whitelist entry exercised through the
+  real handler and store in the test.
 
 ## References
-- Related: none
+- Related: bug-1934
+- Spec: `.kiro/specs/project-config/requirements.md` Requirement 7.5