How can a bytes32[] variable have a custom method (i.e., verifyCalldata)?

The trick is the using A for B directive at line 59:

using MerkleProof for bytes32[]; 

With that operation, you ask Solidity to consider all the methods it finds in the MerkleProof library, having a byte32[] as a first parameter, as valid methods of any byte32[] variable.

So, after that line, for example, all the following functions are valid methods for any byte32[] variable:

function verifyCalldata(bytes32[] calldata proof, bytes32 root, bytes32 leaf) internal pure returns (bool); function processProofCalldata(bytes32[] calldata proof, bytes32 leaf) internal pure returns (bytes32); ... 

As an additional trick, Solidity passes the same variable as the method's first parameter so that the following two syntaxes become equivalent.

// with `using MerkleProof for bytes32[];` return _proof.verifyCalldata(projectMerkleRoot[_projectId], hashAddress(_address)); // without `using MerkleProof for bytes32[];` return MerkleProof.verifyCalldata(_proof, projectMerkleRoot[_projectId], hashAddress(_address)); 

You can read more about the use of the using A for B directive in the official Solidity documentation.

As a side note, library syntax is convenient for clarifying the code, but using it here seems an unnecessary overdesigned magic trick; it introduces misunderstanding instead of making things clearer.

The syntax you expected is the one that makes the most sense to me, so don't take this contract as an example. I suggest developing your contract so that lines of code are straightforward, not stylish.