fix(auth): enforce authorization and ownership rules

[marynes0111]

Objective

Review and correct authorization behavior across protected endpoints.

Scope

• Verify ownership validation for user resources
• Ensure users cannot access resources owned by other users
• Validate authentication and authorization flows
• Ensure correct HTTP status codes are returned

Acceptance Criteria

• Resource ownership is enforced
• Unauthorized requests return 401
• Forbidden access returns 403
• Authorization integration tests pass
• No known authorization defects remain open