fix(scripts): resolve projects per identity in project-resource-graph.sh

[devpie]

Problem

project-resource-graph.sh resolved the project independently of the identity it ran as.

1. A run with --key still took the project from the CLI configuration. That project belongs to the logged-in session; the key is another subject and usually sits in another organization, so every service answered 403 and the run produced a table of unavailable rows. load_cli_defaults ran before resolve_identity and used the bare stackit, so the default profile always won.
2. --all-projects did not help such a key either. stackit project list returns the projects the subject is a member of, and a role on an organization creates no membership. A service account with an organization role got an empty list and the run died with no readable projects, although the same key can read the projects of its organization.

The two defects compound: fixing only the first would leave a key with an organization role without any working way to select a project.

Change

• The project is read from the CLI configuration only when no --key is given. The region is still inherited, because every subject uses the same regions while a project belongs to one. A key run without --project-id or --all-projects stops and says why.
• --all-projects now takes the union of both sources, each project once: stackit project list for the memberships, plus stackit project list --parent-id <organization> for every organization of stackit organization list. An info line names the resulting count, since the meaning of the option widened.
• --help and scripts/README.md describe both rules, including the remaining gap.

Limitation

A project inside a folder is covered by the membership list only. GET /v2/projects returns the projects that are children of the container it is asked for (resource-manager.json), and the CLI 0.72.0 has no command that lists folders. Walking the tree would need stackit curl against a hardcoded endpoint that resource_manager_custom_endpoint can override, so it is left out. Closed in a follow-up.

Tests

Run against a service account key whose role sits on an organization, region eu01:

Case	Result
--key <org key> without a project	stops with the new message
--key <org key> --all-projects --services network	6 projects, 2 readable, 4 reported as unavailable: ... 403
no --key, profile with project_id	takes the configured project as before
no --key, profile without project_id	previous message with the stackit config set hint
--all-projects --delete network/<name>	--delete needs exactly one project, 6 are selected, before any query or prompt

shellcheck and bash -n are clean, prettier@3.1.0 changes nothing in scripts/README.md, check_readme_tags.py passes and generate_agents_md.py produces no diff.

🤖 Generated with Claude Code

[mauritzuph]

Ty!