fix(manifests): scope manifest and stop lookups to the caller's company

[roncodes]

Summary

The manifest controllers resolved manifests, manifest stops and drivers by identifier alone, without constraining the query to the caller's company. Fleetbase has no global company scope, so these lookups could resolve another organization's records.

• Public API (Api/v1/ManifestController): findManifest, findStop, findDriverRecord and manifestsFor are now scoped to session('company'). The public_id OR uuid match is grouped so the company constraint applies to both arms.
• Console (Internal/v1/ManifestController): manifestQueryByPublicId and manifestStopQueryByPublicId, which back show, cancel, destroy, showStop and updateStop, are now scoped the same way.
• Stops have no company_uuid column, so they are owned through their manifest (whereHas('manifest', …)).
• A missing company session fails closed (1 = 0), following scopedToCompany in Internal/v1/OrderController.

session('company') is set by core-api Auth for both API-credential and personal-token requests, so the driver app keeps resolving its own manifests.

Fixes GHSA-m8m5-5qhf-94rv and GHSA-q479-qp9q-mg27.

Tests

• Both test files now seed two companies in SQLite. They assert that the other company's manifests, stops and drivers never resolve, by public_id or by uuid. The endpoints answer 404 (public API) or ModelNotFoundException (console), and nothing is written to the other company's rows. With no company session, nothing resolves.
• The new cross-tenant tests fail against main and pass on this branch.
• The API test's old "lookups go to the database" test accepted any outcome. It is replaced by real query assertions.
• The console test's SQLite manifest_stops table no longer has a company_uuid column that production lacks, so it can't mask a wrong fix.
• Coverage: 100% of lines in both changed controllers (92/92 API, 56/56 console).
• phpstan: no new errors in the touched files compared with main.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (4a4ce41) to head (63637dd).

Additional details and impacted files

@@             Coverage Diff             @@
##                main      #403   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
- Complexity     13585     13590    +5     
===========================================
  Files            634       634           
  Lines          49308     49328   +20     
===========================================
+ Hits           49308     49328   +20     

Flag	Coverage Δ
backend	100.00% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.