fix: scope MCP permission guards to PAT requests and drop the project-count cap

[parth0025]

Two fixes that stop over-restrictive gating from affecting the web app.

Config/permissionGuard.js

• The permission/role guards (requireRole, requirePermission, requireTaskActionPermission) now run ONLY for PAT (MCP / API-token) requests, detected via req.apiToken. JWT / web-app requests fall straight through, so existing frontend/backend behaviour is byte-for-byte unchanged.
• Why: the backend mirror of the frontend checkPermission is not yet a perfect match for per-project overrides, so gating shared web routes caused false denials in production (e.g. assigning a task -> 403). Scoping enforcement to PAT-only removes that risk while keeping MCP / API clients gated.
• Also adds sheet_settings.user_timesheet and sheet_settings.workload_timesheet to MCP_PERMISSION_KEYS.

Modules/createProject/controller.js

• checkProjectPlan no longer enforces a plan project-count cap. Project creation is gated only by the project.project_create permission (route guard + MCP client) — checkProjectPlan now always resolves { status: true }.

Both files syntax-checked (node --check).

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 76c2323c-fffd-46c4-8c1f-ff75e8b9d474

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/permission-guard-and-project-cap

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}