No Location header on 201 Created responses

## Enhancement

**Severity:** Minor (RESTful best practice)
**Found during:** Pre-production stack test (2026-03-26)

### Description

POST endpoints that return 201 (Created) do not include a `Location` header pointing to the newly created resource. Per [RFC 7231 Section 6.3.2](https://datatracker.ietf.org/doc/html/rfc7231#section-6.3.2), 201 responses SHOULD include a Location header with a reference to the new resource.

### Observed

Tested with `POST /project/import?createFrom=URL`:
```
HTTP/1.1 201 Created
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
...
(no Location header)
```

### Expected

```
HTTP/1.1 201 Created
Content-Type: application/json; charset=utf-8
Location: https://dev.api.t-pen.org/project/69c572dcd23148bc4d1251c7
...
```

### Affected Endpoints

All POST endpoints that return 201:
- `POST /project/import`
- `POST /project/import-image`
- `POST /project/create`
- `POST /project/:id/copy` (and variants)
- `POST /project/:id/page/:pageId/line`
- `POST /project/:id/layer`
- `POST /project/:id/page/:pageId/column`
- `POST /project/:id/addCustomRoles`
- `POST /project/:id/invite-member`

### Impact

Low — clients currently extract the new resource ID from the response body, so this is not blocking. Adding the header would improve REST compliance and make the API more predictable for third-party consumers.