feat(app): add "Your projects" view for accessible org & personal packs

[ChipWolf]

What

Adds a Your projects view to the launcher that lists every project the signed-in user can access — their own projects plus every project owned by an organization they belong to — including non-public statuses such as unlisted and private.

Reachable from a new sidebar entry (/your-projects).

Why

The launcher previously only surfaced Modrinth projects through the public search index. That index only contains approved/archived projects, so a user could never see (or easily reach) an org's private packs in the app, even when they're a member with full access. This adds the missing discovery surface.

How

• app-lib — get_user_projects() calls GET /v3/user/{id}/all-projects with the active credentials attached (the shared fetch helper adds auth automatically). It returns { projects, organizations } in one call. It is fetched fresh on every call rather than cached, so results always reflect the current auth state — private packs appear the moment you sign in, with no stale logged-out list lingering.
• Tauri — exposed via a new mr-auth|get_user_projects command and a getUserProjects() frontend helper.
• UI — a new page groups projects by organization (plus a Personal group) and badges each non-public project (Private, Unlisted, In review, …) so members can spot them at a glance. Cards link to the existing project page, where the authenticated fetch + install flow already works for private projects — no install logic was duplicated.

Visibility behavior (worth a reviewer's attention)

The endpoint filters via filter_visible_projects(hide_unlisted = true), so:

• Members get the org's public + archived + unlisted + private projects.
• Non-members (and signed-out users) get only public/archived — identical to the org's public website page.

So private packs surface only for people who actually have access; there is no leak to outsiders.

Testing

• cargo check -p theseus — clean.
• cargo check -p theseus_gui — Rust compiles (fails only later in tauri's frontendDist codegen, which needs the built frontend; unrelated to this change).
• pnpm prepr:frontend:app — 11/11 tasks pass (lint, typecheck, build).

Not yet exercised: a live end-to-end run against a real account with a private org pack — worth a manual smoke test on someone with membership in an org that has a private project.

🤖 Generated with Claude Code

---

Note

Medium Risk
Touches auth session lifecycle, authenticated API access, and cache purging on login/logout—important for preventing private project metadata leakage, but changes are scoped and defensive.

Overview
Adds a Your projects page (/your-projects, gated by your_projects_tab) that loads personal and org projects—including private/unlisted—via a new GET /v3/user/{id}/all-projects path exposed as mr-auth|get_user_projects.

Auth plumbing: AuthProvider gains optional refreshSession; the app wires it to fetchCredentials so pages like Your projects can reconcile when the backend has no active session.

Session-sensitive data: On login finish and logout/session removal, app-lib purges AUTHENTICATED_CACHE_TYPES (projects, versions, orgs, etc.) so cached private metadata cannot leak across accounts or after sign-out.

Home featured modpacks: Featured packs missing from public search are hydrated with authenticated get_project (cache bypass), tagged nonPublic, stripped on auth changes, and the list reloads when session_token changes.

^{Reviewed by Cursor Bugbot for commit df6e69e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d3d65ce. Configure here.}