feat: build access level labels from their bits and project names

Labels came from a fixed table matched by subset, so Storage (no bits)
matched any level the table lacked, and a level was named after the first
entry it contained: the server's Brain/MINDS 2.0 folders (0x10000) showed
as Storage and 0x10104 as CBS or PW Open.

Labels are now composed from the bits. Projects (bit 16 and up) take the
names the server reports to their members through users/current/, and
otherwise Project<n>; restrict slot 1 is CBS and any other Restrict<n>.
A level with no meaning is shown as Unknown (0x...). chacl reads keys
built the same way, refuses public and storage before any request, and
lists the user's projects with their keys when given an invalid level.

tests/test_commands.py

@@ -23,6 +23,7 @@ from mdrsclient.commands import (
     VersionCommand,
     WhoamiCommand,
 )
+from mdrsclient.exceptions import IllegalArgumentException, MissingConfigurationException
 from mdrsclient.models import Folder, Laboratory
 
 
@@ -177,6 +178,7 @@ class TestCommands(unittest.TestCase):
             mock_lab = Laboratory(id=1, name="mylab", pi_name="pi_name", full_name="full_name")
 
             mock_client.resolve_folder.return_value = (mock_folder, mock_lab)
+            mock_client.project_names.return_value = {}
 
             mock_file = MagicMock()
             mock_file.name = "file.txt"
@@ -228,6 +230,7 @@ class TestCommands(unittest.TestCase):
             mock_lab = Laboratory(id=1, name="mylab", pi_name="pi_name", full_name="full_name")
 
             mock_client.resolve_folder.return_value = (mock_folder, mock_lab)
+            mock_client.project_names.return_value = {}
             mock_client.connection.laboratories.find_by_id.return_value = mock_lab
 
             mock_file = MagicMock()
@@ -316,6 +319,48 @@ class TestCommands(unittest.TestCase):
             mock_client_class.from_remote.assert_called_once_with("myremote")
             mock_client.chacl.assert_called_once_with("myremote:/mylab/", 1, True, "secret")
 
+    def test_chacl_command_project_level(self):
+        with patch("mdrsclient.client.MdrsClient") as mock_client_class:
+            mock_client = MagicMock()
+            mock_client_class.from_remote.return_value = mock_client
+
+            args = self.parse_args(ChaclCommand, ["chacl", "cbs_or_project0_open", "myremote:/mylab/"])
+            args.func(args)
+
+            mock_client.chacl.assert_called_once_with("myremote:/mylab/", 0x10100, False, None)
+
+    def test_chacl_command_invalid_level_lists_projects(self):
+        with patch("mdrsclient.client.MdrsClient") as mock_client_class:
+            mock_client = MagicMock()
+            mock_client_class.from_remote.return_value = mock_client
+            mock_client.project_names.return_value = {0: "Brain/MINDS 2.0"}
+
+            args = self.parse_args(ChaclCommand, ["chacl", "5kikan_open", "myremote:/mylab/"])
+            with self.assertRaises(IllegalArgumentException) as cm:
+                args.func(args)
+
+            self.assertIn("project<n>_open", str(cm.exception))
+            self.assertIn("project0_open: Brain/MINDS 2.0", str(cm.exception))
+            mock_client.chacl.assert_not_called()
+
+    def test_chacl_command_invalid_level_without_server(self):
+        with patch("mdrsclient.client.MdrsClient") as mock_client_class:
+            mock_client_class.from_remote.side_effect = MissingConfigurationException("no remote")
+
+            args = self.parse_args(ChaclCommand, ["chacl", "5kikan_open", "myremote:/mylab/"])
+            with self.assertRaises(IllegalArgumentException) as cm:
+                args.func(args)
+
+            self.assertNotIn("Projects you belong to", str(cm.exception))
+
+    def test_chacl_command_refuses_public_and_storage(self):
+        for level in ("public", "storage"):
+            with self.subTest(level=level), patch("mdrsclient.client.MdrsClient") as mock_client_class:
+                args = self.parse_args(ChaclCommand, ["chacl", level, "myremote:/mylab/"])
+                with self.assertRaises(IllegalArgumentException):
+                    args.func(args)
+                mock_client_class.from_remote.assert_not_called()
+
     def test_metadata_command(self):
         with patch("mdrsclient.client.MdrsClient") as mock_client_class:
             mock_client = MagicMock()