Security P3 — Fix authenticated IDORs: summaries, enhancements, messaging, dashboards, analytics

[franciszver]

Part of #59.

Part of the broken-access-control remediation epic. Depends on Phase 1. These routes authenticate correctly but never check object ownership.

Findings addressed

• Potential fix for code scanning alert no. 9: Information exposure through an exception #1 summaries.py:104 — GET /summaries/{user_id} queries Summary.student_id == user_id with no ownership check; the tutor branch trusts a caller-supplied role param. Add ownership/relationship check before the query.
• Potential fix for code scanning alert no. 6: Information exposure through an exception #4 enhancements.py:82 — get_conversation_context omits the self-check that its sibling get_conversation_history (:57) already has. Copy that check in.
• Potential fix for code scanning alert no. 1: Information exposure through an exception #5 messaging.py:224 — GET /messaging/threads?user_id= uses a caller-supplied user_id instead of the JWT identity. Reject/ignore a user_id that isn't the authenticated user (or gate to admin).
• Potential fix for code scanning alert no. 2: Information exposure through an exception #6 dashboards.py:29 — parent dashboards enforce only role (self-registerable) and return all students. Enforce parent↔student link per Phase 0, or restrict to admin; stop returning all students.
• Phase 1: OpenRouter free-tier AI provider + CI lint fix #10 advanced_analytics.py:100 — engagement/{user_id} returns any student's activity profile to any tutor/parent. Add relationship check or restrict to admin.

Definition of Done

• Each route calls the Phase‑1 helper (or equivalent) before returning data.
• Cross-user access returns 403; owner/related/admin still works.
• dashboards no longer enumerates all students for non-admins.

Affected files

src/api/handlers/summaries.py, enhancements.py, messaging.py, dashboards.py, advanced_analytics.py

[franciszver]

Done and merged to main in PR #66 (part of epic #59).