Deny foreign user_id upsert without manage rights (403); unique project names in ctxmgr PG fixture for global name index; add test-env data repair SQL. Co-authored-by: Cursor <cursoragent@cursor.com>