feat: add web UI project registry and onboarding (#427)

Load projects from versioned webui/data/projects.registry.json with profile
mappings, workflow/schema paths, and read-only onboarding checklist UI.
Seeds Gitea-Tools; exposes /projects, /projects/{id}, and /api/projects.

Closes #427

docs/webui-local-dev.md

@@ -36,7 +36,9 @@ Optional environment variables:
 |------|-------------|
 | `/` | Home / operator overview |
 | `/health` | JSON liveness (`status`, `service`, `mode`, `timestamp`) |
-| `/projects` | Stub — registry (#427) |
+| `/projects` | Project registry list (#427) |
+| `/projects/{id}` | Project detail + onboarding checklist |
+| `/api/projects` | JSON registry export |
 | `/prompts` | Stub — prompt library (#428) |
 | `/runtime` | Stub — MCP runtime health (#430) |
 | `/audit` | Stub — report audit paste (#431) |
@@ -46,8 +48,20 @@ Optional environment variables:
 All routes are GET-only. POST/PUT/PATCH/DELETE return `405` with
 `read-only-mvp`.
 
+## Project registry (#427)
+
+Versioned registry file: `webui/data/projects.registry.json` (schema version `1`).
+
+Override path with `WEBUI_PROJECT_REGISTRY` when operators keep a machine-local
+copy outside git. The registry stores repo identity, remotes, profile names,
+workflow/schema path references, and onboarding checklist steps — never tokens
+or credentials.
+
+Seed entry: **Gitea-Tools** on `https://gitea.prgs.cc` with `prgs-author`,
+`prgs-reviewer`, and `prgs-reconciler` profiles.
+
 ## Tests
 
 ```bash
-pytest tests/test_webui_skeleton.py -q
+pytest tests/test_webui_skeleton.py tests/test_webui_project_registry.py -q
 ```