fix(sanity): resolve 15 gaps from sanity check audit (G-01 through G-15)

- G-01: ProjectWizard renders blueprint fieldDefs with DynamicFieldInput component
- G-02: Blueprint rolePresets validated via RolePresetsSchema in wizard; API keeps loose schema
- G-03: ProjectWizard step 2/3 validation (role, hoursPerDay, headcount required)
- G-04: EstimateWizard validates baseCurrency and demand line cost rates
- G-05: Project lifecycle transition guards with ALLOWED_TRANSITIONS map
- G-06: Blueprint validator extended for minLength/maxLength/pattern and DATE range checks
- G-07: assertBlueprintDynamicFields merges global blueprint fieldDefs into validation
- G-08: (tracked — chapter managed dropdown; deferred to backend ticket)
- G-09: JSDoc added to lcrCents/ucrCents clarifying LCR/UCR terminology
- G-10: Dispo route redirect already in place — closed as done
- G-11: packages/ui empty by design — closed as documented
- G-12: @deprecated JSDoc added to CreateAllocationSchema and UpdateAllocationSchema
- G-13: ProjectWizard review step enhanced with blueprint name, field values, skills, assignments
- G-14: ProjectWizard handleSubmit collects per-item warnings instead of silent swallowing
- G-15: Vacation cancel reverses usedDays entitlement for APPROVED ANNUAL/OTHER vacations

Tests: all 1575 passing (1 pre-existing failure in insights-summary unrelated to these changes)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/api/src/router/project-lifecycle.ts

@@ -1,6 +1,15 @@
 import { PermissionKey, ProjectStatus } from "@capakraken/shared";
 import { TRPCError } from "@trpc/server";
 import { z } from "zod";
+
+// ─── Allowed status transitions ───────────────────────────────────────────────
+const ALLOWED_TRANSITIONS: Record<ProjectStatus, ProjectStatus[]> = {
+  [ProjectStatus.DRAFT]:     [ProjectStatus.ACTIVE, ProjectStatus.CANCELLED],
+  [ProjectStatus.ACTIVE]:    [ProjectStatus.ON_HOLD, ProjectStatus.COMPLETED, ProjectStatus.CANCELLED],
+  [ProjectStatus.ON_HOLD]:   [ProjectStatus.ACTIVE, ProjectStatus.CANCELLED],
+  [ProjectStatus.COMPLETED]: [ProjectStatus.ACTIVE],          // re-open only
+  [ProjectStatus.CANCELLED]: [ProjectStatus.DRAFT],           // revive only
+};
 import { adminProcedure, managerProcedure, requirePermission, type TRPCContext } from "../trpc.js";
 
 type ProjectLifecycleContext = Pick<TRPCContext, "db" | "dbUser"> & {
@@ -73,6 +82,24 @@ export function createProjectLifecycleProcedures(
       .input(z.object({ id: z.string(), status: z.nativeEnum(ProjectStatus) }))
       .mutation(async ({ ctx, input }) => {
         requirePermission(ctx, PermissionKey.MANAGE_PROJECTS);
+
+        const current = await ctx.db.project.findUnique({
+          where: { id: input.id },
+          select: { id: true, status: true },
+        });
+        if (!current) {
+          throw new TRPCError({ code: "NOT_FOUND", message: "Project not found" });
+        }
+        if (current.status !== input.status) {
+          const allowed = ALLOWED_TRANSITIONS[current.status] ?? [];
+          if (!allowed.includes(input.status)) {
+            throw new TRPCError({
+              code: "BAD_REQUEST",
+              message: `Cannot transition project from ${current.status} to ${input.status}. Allowed: ${allowed.join(", ") || "none"}.`,
+            });
+          }
+        }
+
         const result = await ctx.db.project.update({
           where: { id: input.id },
           data: { status: input.status },