Only show active projects for users (admin or production)

- use 404 status code instead of 403 for unauthorized access
- add Project.production subset
- add Role.admin subset
- add eager_each plugin to Role
- add roles_with_active_projects association to User