De-duplicate controller boilerplate: owned-project lookup, reorder validation

requireOwnedProjectId() was copy-pasted identically in CardController
and CardStatusController; ProjectController's own
requireOwnedProject() was the same lookup, just returning the full
row instead of the id. New abstract ProjectScopedController (extends
Controller) holds one copy of both, and all three controllers now
extend it instead of Controller directly, forwarding their
ProjectRepository to its constructor.

Separately, CardController::reorder() (card_ids) and
CardStatusController::reorder() (status_ids) each had the same inline
'must be an array of ids, no duplicates' check. Both now call a new
Validator::intIdArray(), which does the same shape check once.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/Http/Controllers/ProjectController.php

@@ -15,16 +15,17 @@ use Psr\Http\Message\ServerRequestInterface as Request;
  * CRUD for the authenticated user's projects. A project is only ever visible to
  * its owner; anything else responds 404.
  */
-final class ProjectController extends Controller
+final class ProjectController extends ProjectScopedController
 {
     private const TITLE_MAX = 255;
     private const DESCRIPTION_MAX = 2000;
     private const MAX_PROJECTS_PER_OWNER = 100;
 
     public function __construct(
-        private readonly ProjectRepository $projects,
+        ProjectRepository $projects,
         private readonly CardStatusRepository $statuses,
     ) {
+        parent::__construct($projects);
     }
 
     /**
@@ -105,24 +106,6 @@ final class ProjectController extends Controller
         return $response->withStatus(204);
     }
 
-    /**
-     * Load the project named in the route, or 404 if it is missing or not owned
-     * by the authenticated user.
-     *
-     * @param array<string, string> $args
-     * @return array{id: int, owner_id: int, title: string, description: string, card_count: int, completed_count: int, created_at: string, updated_at: string}
-     */
-    private function requireOwnedProject(Request $request, array $args): array
-    {
-        $project = $this->projects->findOwnedBy((int) $args['projectId'], $this->user($request)['id']);
-
-        if ($project === null) {
-            throw new ApiException('Project not found.', 404);
-        }
-
-        return $project;
-    }
-
     /**
      * @param array{id: int, owner_id: int, title: string, description: string, card_count: int, completed_count: int, created_at: string, updated_at: string} $project
      * @return array<string, mixed>