fix(store): a resource create never moves a live resource to another project or org - #2000

Summary

A resource create no longer moves a live resource to another project or organization. Stacked on #1985.

Changes

• The URN upsert in ResourceRepository.Create updates the existing live row only when it has the same project_id, compared with IS NOT DISTINCT FROM so two organization resources, both without a project, still match. Otherwise no row comes back and Create returns ErrConflict, which the handlers answer with already exists.
• The service returns before it touches SpiceDB, so a refused create leaves the existing row's tuples alone.

Technical Details

• Two live resources from different parents share a URN only in rare cases:
  • A project named exactly like an organization id. Its resources get the URNs of that organization's resources when they share a namespace and a name. This is very unlikely, since it needs a project named after an org id and one namespace used at both levels, so the check is defensive.
  • A live resource whose project row is gone. This cannot happen today: the project delete purges its resources first, and the project_id foreign key has no delete action.
• Re-creating a resource in the same project or the same organization still updates it in place, and the organization fill on older rows still works.

Test Plan

• go test ./internal/store/postgres/ passes. New TestCreate cases: an organization resource re-created with the same URN updates in place; the URN of another project's live resource returns conflict and the row keeps its project; a project resource and an organization resource sharing a URN return conflict both ways.
• Without the Where, the two conflict cases fail. With = in place of IS NOT DISTINCT FROM, the organization re-create case fails.
• go test ./test/e2e/... passes.
• golangci-lint run reports no issues.

SQL Safety

• The goqu.L in the conflict update takes two goqu.I identifiers and no values.
• ToSQL() callers capture and forward params (query, params, err := stmt.ToSQL(); db.…Context(ctx, …, query, params...)). Never query, _, err := ….
• No ? placeholders inside single-quoted SQL literals in goqu.L.
• No new //nolint:forbidigo or // #nosec G20x annotations.