Accept browser-placed research references with UUID ids

The research service mints UUID request ids, but the room's projection
authorizer rejected any id that was not a ULID before consulting storage.
Every /research submission was therefore rejected as a protected
projection, the room rebuilt, and the card vanished while the request ran.

Drop the ULID shape gate; the stored workspace, its initial turn, and its
linked job remain the authority. Test fixtures now mint UUID ids like
production so this mismatch cannot hide again.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>