fix: Allow project team members to update projects, handle empty companyId

- Relax project PATCH route from requireAdmin to checkProjectAccess
- Normalize empty string companyId to null in updateProject service to prevent UUID parse error

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/routes/project.routes.js

@@ -44,10 +44,10 @@ router.post(
   projectController.createProject
 );
 
-// Update project (admin only)
+// Update project (team members and admins)
 router.patch(
   '/:projectId',
-  requireAdmin,
+  checkProjectAccess,
   validateParams(z.object({ projectId: z.string().uuid() })),
   validateBody(updateProjectSchema),
   projectController.updateProject

src/services/project.service.js

@@ -157,12 +157,15 @@ export const updateProject = async (projectId, data) => {
 
   const { name, description, companyId, status, startDate, endDate } = data;
 
+  // Treat empty string companyId as null (no company)
+  const resolvedCompanyId = companyId === '' ? null : companyId;
+
   // If companyId is being changed, verify new company exists
-  if (companyId !== undefined && companyId !== null && companyId !== project.companyId) {
+  if (resolvedCompanyId !== undefined && resolvedCompanyId !== null && resolvedCompanyId !== project.companyId) {
     const [company] = await db
       .select()
       .from(companies)
-      .where(eq(companies.id, companyId))
+      .where(eq(companies.id, resolvedCompanyId))
       .limit(1);
 
     if (!company) {
@@ -175,7 +178,7 @@ export const updateProject = async (projectId, data) => {
     .set({
       name: name !== undefined ? name : project.name,
       description: description !== undefined ? description : project.description,
-      companyId: companyId !== undefined ? companyId : project.companyId,
+      companyId: resolvedCompanyId !== undefined ? resolvedCompanyId : project.companyId,
       status: status !== undefined ? status : project.status,
       startDate: startDate !== undefined ? (startDate ? new Date(startDate) : null) : project.startDate,
       endDate: endDate !== undefined ? (endDate ? new Date(endDate) : null) : project.endDate,