Restrict project video playback until group closes

[sentry-junior]

Individual demo videos should be watchable by admins and the project's own team while submissions are open, then by everyone after the relevant submissions close. Individual playback should live on the project page rather than a separate project-video page.

Current behavior

• The project page requests playback for every ready video and embeds it directly.
• getProjectVideo, issuePlayback, and getVideoContent do not check project ownership, admin role, or submission closure. A known video ID can therefore reach both playback metadata and content.
• The router also exposes a standalone project-video page.

Requested behavior and build scope

• Before closure, allow individual playback only for admins or the project's creator/team members.
• After closure, allow all authenticated users to watch the project's ready video on its project page.
• Use the project's group closure once group-level closure exists; retain year/archive behavior where applicable.
• Enforce the rule server-side for video lookup, playback metadata, and content delivery so direct URLs cannot bypass it.
• Remove or redirect the standalone project-video route; keep screening-reel playback on the watch page.
• Return enough permission state for the project page to hide playback cleanly, and cover owner, teammate, outsider, admin, open-group, and closed-group cases in API and UI tests.

Requested by daniel.

--

View Junior Session [Sentry]