fix(security): scope public related bookmarks

[Melvynx]

Summary

• Security hotfix from the 2026-07-06 weekly audit.
• Scope public related-bookmark suggestions to the owner of the public bookmark.
• Add a small query-builder helper and regression test so the public related-bookmark predicate keeps userId owner scoping.

Test Plan

• git diff --check
• Static added-line scan for hardcoded secrets and dangerous shell/eval/deserialization/SQL patterns
• Spec compliance review: PASS
• Independent code review: PASS
• pnpm --filter web exec vitest run __tests__/public-bookmarks-related-security.test.ts --reporter=verbose blocked locally by Node/V8 WebAssembly OOM
• NODE_OPTIONS=--jitless pnpm --filter web ts ran but failed on unrelated existing TypeScript/Prisma generation issues
• NODE_OPTIONS=--jitless pnpm --filter web lint blocked by WebAssembly requirement in the lint stack

Risk / Rollback

• Low-risk query tightening. Public pages may show fewer related bookmarks, but should not show other users' bookmarks.
• Rollback by reverting this commit if the related-bookmark UI regresses unexpectedly.

Known baseline failures

• Local verification is noisy in this cron environment: Vitest and Prisma/lint tooling fail from Node/V8 WebAssembly/OOM and unrelated existing TS/Prisma issues.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
saveit-now-web	Ready	Preview, Comment	Jul 6, 2026 9:10am