Add a "new card" form to each kanban column

Each column gets its own form at the bottom (styled like the sidebar
inbox's), creating the card directly in that status, appended after
its existing cards.

- API: POST /projects/{id}/cards takes an optional status_id, which
  must belong to the project (422 otherwise); omitted, it still
  defaults to the project's first status as before. Position is
  already "end of that status" for free -- createInProject() already
  ranks by (owner, project, status).
- cards store: add() takes an optional statusId, forwarded as
  status_id when given.
- ProjectView: one draft string per status (keyed by status id) so
  typing in one column doesn't touch another's, mirroring the
  per-status independence the columns already have for reordering.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/CardOrderTest.php

@@ -119,6 +119,65 @@ final class CardOrderTest extends ApiTestCase
         self::assertSame([null, null, null], array_column($this->inbox($auth), 'project_id'));
     }
 
+    public function test_creating_a_project_card_in_a_given_status(): void
+    {
+        $auth = $this->authHeader();
+        $projectId = $this->newProject($auth);
+        $doing = $this->statuses($projectId, $auth)[1]['id'];
+        $this->addToProject($projectId, 'Already doing this', $auth); // lands in "To do", not "Doing"
+
+        $response = $this->request(
+            'POST',
+            "/api/projects/{$projectId}/cards",
+            ['text' => 'Start this', 'status_id' => $doing],
+            $auth,
+        );
+
+        self::assertSame(201, $response->getStatusCode());
+        $card = $this->decode($response)['card'];
+        self::assertSame($doing, $card['status_id']);
+        self::assertSame(0, $card['position']); // first (and only) card in "Doing" so far
+    }
+
+    public function test_creating_a_project_card_appends_to_the_end_of_its_status(): void
+    {
+        $auth = $this->authHeader();
+        $projectId = $this->newProject($auth);
+        $doing = $this->statuses($projectId, $auth)[1]['id'];
+        $first = $this->request(
+            'POST',
+            "/api/projects/{$projectId}/cards",
+            ['text' => 'First', 'status_id' => $doing],
+            $auth,
+        );
+
+        $second = $this->request(
+            'POST',
+            "/api/projects/{$projectId}/cards",
+            ['text' => 'Second', 'status_id' => $doing],
+            $auth,
+        );
+
+        self::assertSame(0, $this->decode($first)['card']['position']);
+        self::assertSame(1, $this->decode($second)['card']['position']);
+    }
+
+    public function test_creating_a_project_card_rejects_a_status_from_another_project(): void
+    {
+        $auth = $this->authHeader();
+        $projectId = $this->newProject($auth, 'A');
+        $otherStatus = $this->statuses($this->newProject($auth, 'B'), $auth)[0]['id'];
+
+        $response = $this->request(
+            'POST',
+            "/api/projects/{$projectId}/cards",
+            ['text' => 'x', 'status_id' => $otherStatus],
+            $auth,
+        );
+
+        self::assertSame(422, $response->getStatusCode());
+    }
+
     // --- reordering within a column --------------------------------------
 
     public function test_reorder_within_the_inbox(): void