Add project access denial appeal guard

[AlonePenguin]

/claim #11

Summary

• Adds a self-contained project-access-denial-appeal-guard/ module for User & Project Management.
• Evaluates denied restricted-project access requests and appeal packets before final requester-facing decisions are sent.
• Checks denial reason specificity, appeal-window timeliness, reviewer independence, training/DUA/IRB evidence, object-level scope, private-note redaction, and audit receipt completeness.
• Emits deterministic JSON, Markdown, SVG, manifest, and H.264 MP4 reviewer artifacts from synthetic fixtures only.

Non-overlap

This is distinct from existing #11 slices such as broad RBAC/workspace ledgers, privacy access review, member lifecycle/offboarding, institutional recertification, anonymous-review escrow, data-room consent, researcher profile sync, archive handoff, access-audit anomaly, role delegation, invitation-domain/MFA, funding attribution, service-token governance, deletion/erasure, break-glass access, visibility transition, provisioning baseline, object-permission inheritance, collaborator COI, data-residency, authoring artifact integrity, and ORCID publication disambiguation. This slice focuses specifically on post-denial appeal governance and requester-safe receipts.

Validation

• npm run check
• npm test
• npm run demo
• npm run verify-video -> H.264, 960x540, 4.0 seconds
• LC_ALL=C rg -n "[^\x00-\x7F]" project-access-denial-appeal-guard || true -> no output
• git diff --check -- project-access-denial-appeal-guard

Attempt marker: #11 (comment)

Synthetic data only. No identity-provider calls, credentials, live projects, private user data, payment processors, or external APIs are used.

AI-assisted with OpenAI Codex; I reviewed and locally verified the diff before submitting.