fix: harden project writes and uploads

tests/test_projects.py

@@ -113,6 +113,45 @@ class ProjectServiceTests(unittest.TestCase):
         self.assertEqual(result["error"]["code"], "invalid_project_input")
         self.assertEqual(self.nb.update_calls, [])
 
+    def test_create_rejects_nested_scalar_inputs_before_writing(self) -> None:
+        cases = {
+            "name": {"name": "x"},
+            "customer_id": {"id": 3},
+            "inquiry_date": ["2026-07-12"],
+            "progress": ("SOP",),
+            "applications": ["EV"],
+            "part_numbers": ("123",),
+            "period_usage": {"annual"},
+            "details": {"note": "x"},
+        }
+
+        for field, value in cases.items():
+            with self.subTest(field=field):
+                self.setUp()
+                arguments = {"name": "x", **{field: value}}
+                result = self.service.create_project(**arguments)
+
+                self.assertEqual(result["error"]["code"], "invalid_project_input")
+                self.assertEqual(self.nb.create_calls, [])
+                self.assertEqual(self.http.add_calls, [])
+
+    def test_update_rejects_nested_project_id_before_any_client_call(self) -> None:
+        for project_id in ({"id": 41}, [41], {41}, (41,)):
+            with self.subTest(project_id=project_id):
+                self.setUp()
+                result = self.service.update_project(project_id, name="x", add_attachment_ids=[8])
+
+                self.assertEqual(result["error"]["code"], "invalid_project_input")
+                self.assertEqual(self.nb.update_calls, [])
+                self.assertEqual(self.http.add_calls, [])
+
+    def test_create_rejects_nested_attachment_id_before_any_client_call(self) -> None:
+        result = self.service.create_project(name="x", attachment_ids=[{"id": 8}])
+
+        self.assertEqual(result["error"]["code"], "invalid_project_input")
+        self.assertEqual(self.nb.create_calls, [])
+        self.assertEqual(self.http.add_calls, [])
+
     def test_update_writes_scalars_then_deduplicated_attachment_changes_in_order(self) -> None:
         result = self.service.update_project(
             41,