Add backfill-projects admin CLI command

[geoffjay]

Important

Stack this on top of the work performed in #1306, do not create new branches off of main, use the work that was started there

Summary

Add an `agent admin backfill-projects` CLI command to copy project rows from orchestrator's SQLite database into core's SQLite database, preserving UUIDs so all existing `project_id` references across services (orchestrator agents/workflows, communicate rooms, knowledge documents) continue resolving.

Context

Phase 2 of #1305 (Migrate projects entity from orchestrator into core). After core has the projects table (Phase 1), existing data must be migrated from orchestrator to core before consumers can be repointed (Phase 4).

Blocked By

• Add project CRUD API routes to core crate #1309 (core project API must exist and be functional)

Acceptance Criteria

CLI subcommand

• Add `BackfillProjects` variant to `AdminCommand` enum in `crates/cli/src/commands/admin.rs`
• Accept flags: `--dry-run` (preview without writing), `--org-id ` (optional, scope to specific org)
• Support `--json` output format (inherited from parent admin command)

Backfill logic

• Open orchestrator's SQLite database (use `DB_SERVICES` pattern from `backfill_tenant`)
• Read all rows from orchestrator's `projects` table
• If `--org-id` provided, filter to matching `organization_id` (include NULL rows)
• Open core's SQLite database
• For each orchestrator project row, insert into core's `projects` table preserving the original `id` (UUID)
• Skip rows that already exist in core by `id` (make the command idempotent)
• Report counts: total found in orchestrator, inserted into core, skipped (already exist), errors

Output format

• Human-readable table output following `backfill_tenant` style (colored icons, counts)
• JSON output with `--json` flag: array of `{id, name, status: "inserted"|"skipped"|"error", error?}`
• In dry-run mode, show "would insert" instead of "inserted"

Tests

• Test that `--org-id ""` is rejected
• Test idempotency (running twice produces same result, second run all skipped)

Reference Files

• Pattern: `crates/cli/src/commands/admin.rs:149-238` (`backfill_tenant` function)
• DB services: `crates/cli/src/commands/admin.rs:76-89` (`SCOPED_TABLES`, `DB_SERVICES`)
• Orchestrator project table schema: `crates/orchestrator/src/entity/project.rs`
• Core project storage: `crates/core/src/project_storage.rs` (created in Add project entity, migration, and storage to core crate #1308)

Stack Base

Stack on: `feature/projects-to-core`
Blocked by: #1309

[geoffjay]

All work implemented and PRs submitted as a stacked branch chain.

Stack:

• epic-1310 → PR epic: Add backfill-projects admin CLI command (#1310) #1323 (rollup, targets feature/projects-to-core)
• issue-1310 → PR feat: add backfill-projects admin CLI command #1324 (implementation, targets epic-1310, labeled review-agent)

What was implemented:

• BackfillProjects variant added to AdminCommand enum in crates/cli/src/commands/admin.rs
• Flags: --dry-run and optional --org-id <ID>
• Reads orchestrator's projects table via raw SQL (no new crate dependency needed)
• Opens core's DB via get_db_path("agentd-core", "core.db")
• Inserts rows preserving original UUIDs; skips existing rows by id (fully idempotent)
• Human-readable output with colored icons + count summary; --json flag supported
• Dry-run mode shows would_insert without writing
• 6 new tests: empty-org-id rejection, first-run inserts, idempotency, dry-run no-op, org-id filter with NULL inclusion

All 11 tests (5 existing + 6 new) pass. cargo fmt and cargo clippy both clean.