Authorize project board routes

[bjarn]

Summary

• Scope board route binding to the selected project.
• Return not found for hidden boards.
• Use project visibility rules, including private project membership.
• Add tests for hidden and cross-project boards.

Security impact

A user could access a hidden board or select a board from another project through route identifiers.

Tests

• php artisan test --compact tests/Feature/Controllers/BoardsControllerTest.php