Security P1 — Shared object-access authz helper + cross-user 403 test harness

[franciszver]

Part of #59.

Part of the broken-access-control remediation epic. Depends on Phase 0. This is the foundation — most findings are fixed by applying this one helper.

Goal

Add a single reusable object-level authorization primitive and a regression test harness, so every user-scoped route enforces access consistently instead of each handler reinventing (or omitting) the check.

Work

1. Authorization helper — e.g. a dependency require_object_access(db_user, target_student_id) encapsulating the Phase‑0 policy:
   • db_user.id == target_student_id, OR
   • role == "tutor" AND a matching TutorStudentAssignment exists (src/models/tutor_student.py), OR
   • role == "parent" AND a matching parent link exists (per Phase 0), OR
   • role == "admin"
   • else raise 403.
   • Model it on the existing correct checks in enhancements.get_conversation_history and messaging.get_thread.
2. Red-first test harness — a parametrized test asserting that a second, unrelated authenticated user receives 403 for every user-scoped route. Land these red before the Phase 2–4 fixes turn them green (per repo TDD norm).

Definition of Done

• Helper implemented + unit-tested (owner allowed; unrelated user 403; each role branch covered).
• Cross-user 403 test scaffold exists and enumerates the routes fixed in Phases 2–4.
• No behavior change to already-correct routes.

Affected / reference files

• New helper (location TBD, e.g. src/api/middleware/authz.py)
• src/models/tutor_student.py (existing, currently unused)
• Patterns: src/api/handlers/enhancements.py:57, src/api/handlers/messaging.py:320

[franciszver]

Done and merged to main in PR #66 (part of epic #59).