fix(web): reuse project combobox in timeline popovers

docs/route-access-matrix.md

@@ -73,6 +73,17 @@ Reasoning:
 - `list`: `controller-finance`
 - drafting, versioning, export generation, and approval writes: `manager-write`
 
+### `packages/api/src/router/comment.ts`
+
+- `list`, `count`, `create`, `resolve`, `delete`: `entity-scoped`
+
+Reasoning:
+
+- comments must inherit the audience of the backing entity, not the comment row itself
+- Phase 1 intentionally supports only `estimate`, because that is the only real product consumer today
+- estimate comments therefore inherit the estimate workspace audience: controller, manager, or admin
+- future entity types must be added through an explicit registry with per-entity access checks, assistant parity, and router tests in the same slice
+
 ### `packages/api/src/router/system-role-config.ts`
 
 - all reads and writes: `admin-only`