IIRC the custom project members Horizon panel uses novaadmin credentials due to some upstream limitation. That unfortunately blocks using OpenTofu or other API clients to manage project membership.
This limitation should not be a problem for Cloud admins using tofu-infra, where novaadmin credentials can be used. It is a problem for folks using OpenTofu to manage their own Cloud VPS project.