[api] remember some values in user and project model

It's a rather simple join to find out if a project is locked, but there is no
point in repeating it 10 times
[webui] make buildresult a backend model

There is no need to go through the API for /build