feat(projects): cancel in-flight chat streams and analysis

[Hustler490]

Closes #101

What

A client can now stop an in-flight project chat stream or analysis.

Changes

• app/services/cancellation.py - a bounded, thread-safe cancellation registry keyed by request_id (LRU-capped, cleared when a request finishes).
• app/workspaces/routes.py
  • POST /api/projects/<id>/chat/stream now:
    • checks is_cancelled between chunks and stops yielding immediately,
    • catches GeneratorExit on client disconnect, closes the provider stream, and persists no partial assistant message,
    • persists the accumulated streamed text on normal completion (removing the previous second full provider call),
    • clears its request_id when done.
  • POST /api/projects/<id>/analyze checks the same signal before running and again before its side effects; if cancelled it returns {cancelled: true} and skips activity/notification/event writes.
  • POST /api/projects/<id>/cancel marks a request_id as cancelled (owner-scoped).

Acceptance criteria

• A cancel action aborts the stream and does not persist a partial assistant message.
• The SSE route checks for disconnect and stops yielding tokens.
• Non-streaming analyze has an equivalent cancellation path.

Validation

• pytest tests/test_project_cancel.py tests/test_project_routes.py tests/test_chat_settings.py tests/test_rate_limit_endpoints.py tests/test_event_wiring.py -> all pass.
• ruff check and black --check clean on the changed files.
• Full suite: only the pre-existing test_migrations.py::test_conversation_shares_table_upgraded fails (stale column assertion, unrelated).