Add project maintainers instead of a single owner

### Description
Replace the assumption that every project has exactly one maintainer.

### Potential model:

```bash
Project
*
|
*
ProjectMaintainer
|
*
|
1
User
```

Roles could eventually include owner and maintainer.

### Acceptance criteria
- one canonical owner remains required
- multiple maintainers supported
- authorization rules are explicit
- public listing shows maintainers

No files, tests, or entry points are named. Start by tracing the current single-owner Project/User relationship, authorization paths, and public listing; then define explicit owner and maintainer rules and verify the acceptance criteria for required ownership, multiple maintainers, authorization, and public display.

Written by the indexing model from the issue text.