Scheduler skips auth_rejected accounts for tasks

Bug seen on dev (Gmind org, Task 12443): a coder task with Account = Any was dispatched three times in a row onto Claude API-key accounts whose quota_status is `auth_rejected` (arqmulpj1jva, arqmulpjraia, then arqmulpj1jva again). Each attempt failed within a minute (`reported_failure`, `auth_expired`) while a healthy key (t7281-claude-key) was enabled in the same org. Pinning the healthy account made the next dispatch run. Ask: account selection for Any must skip accounts whose quota_status is auth_rejected (and not retry the same rejected account on the next dispatch), falling back to waiting with a clear reason when no healthy account remains. Also review (security): for a node principal `GET /api/projects` (`routes/portfolio.py::list_projects`) returns every live org's projects, so a tenant's node receives other tenants' project rows via the daemon's `projects.list`. Decide whether to scope it to the node's org(s); record the decision. Out of scope: the socket reply cap (fixed in Task 12443's PR). Done means: - A test proves an auth_rejected account is never chosen for Any while a healthy one exists. - The projects.list scope decision is implemented or recorded with its reason. - Required checks: ./dc check quick, changed-area tests, merge lane full gate.

Refused API keys' auth_rejected verdict now stands 24h (rotation lifts it), so Any picks skip them for a healthy key; node projects.list scoped to its org. Quick gate + changed-area suites green; review lanes pass; PR #7683 queued in merge lane.