project note handlers return 500 instead of 404 for a nonexistent project

[ericfitz]

Same class as #579, found while fixing it but out of scope there.

api/project_note_handlers.go has six sites (roughly lines 24-29, 93-98, 167-172, 212-217, 301-306, 375-380) where a NON-admin caller requesting a nonexistent project gets IsProjectTeamMemberOrAdmin returning gorm.ErrRecordNotFound, which is mapped to 500 "Failed to check authorization" instead of 404.

CATS never hit this because the fuzzing identity is an admin, and the admin fast path skips the project lookup entirely.

404 is already documented for all note operations, so this is a handler-only fix following the same pattern as the #579 change. Violates the zero-500 policy.

team_note_handlers.go is NOT affected — IsTeamMemberOrAdmin uses a Count query that cannot return ErrRecordNotFound, so a nonexistent team yields 403.

[ericfitz]

Fixed on dev/1.6.0/cats-fixes (unpushed).

Collapsed the six duplicated blocks into one requireProjectTeamMemberOrAdmin helper that maps gorm.ErrRecordNotFound to 404 — a helper rather than six edits, because the mapping had just drifted at all six sites simultaneously.

Verified live with a non-admin identity (alice) against a nonexistent project:

GET  /projects/{missing}/notes            -> 404 {"error":"not_found","error_description":"Project not found"}
POST /projects/{missing}/notes            -> 404 (same)
GET  /projects/{missing}/notes/{note_id}  -> 404

team_note_handlers.go is confirmed unaffected as the issue predicted — IsTeamMemberOrAdmin uses a Count query that cannot return ErrRecordNotFound.

404 was already documented for every affected operation, so no spec change.

One thing this surfaced

Verifying with an admin identity showed GET /projects/{missing}/notes returns 200 with an empty list, because the admin fast path authorizes before the project is ever looked up. So the two callers now get different status codes for the same nonexistent project. Same for teams; threat-model sub-resources get it right. Filed separately as #609 rather than widened into this fix, since it is a listing-behaviour change rather than an error-classification one.

[ericfitz]

Fixed by 5180d2f9 — project note handlers return 404 rather than 500 for a nonexistent project (api/project_note_handlers.go).

Broadened by 05417b57, which extended the same treatment to team notes and to the admin path, where a privileged caller was still reaching the 500 (see #609).