v1.0.9 Authentication and authorization audit

[sudoshi]

Roadmap execution issue derived from ROADMAP.md.

Release: v1.0.9
Category: Security
Area: Authentication & Authorization
Priority: P0
Risk: High
Work Type: Audit
Target Date: 2026-05-04

Verify that authentication, authorization, and ownership checks are enforced across the API surface.

Scope:

• Pen-test all API controllers for auth bypass, privilege escalation, and IDOR.
• Validate Sanctum token lifecycle behavior.
• Audit every route in api.php against the auth, permission, and ownership model.
• Confirm RBAC role hierarchy boundaries.

Done Criteria

• Implementation, audit, or validation work is completed for this scope.
• Evidence is captured with code, tests, or review notes as appropriate.
• Documentation is updated when the work changes user or developer behavior.