Security P5 — Verify green, regression gate, PR-template check

[franciszver]

Part of #59.

Part of the broken-access-control remediation epic. Depends on Phases 2–4. Verification and regression prevention.

Work

• Run the full Phase‑1 cross-user 403 test suite green across every fixed route.
• Add a PR-template checklist item: "Any route taking a *_id must call the object-access helper."
• Re-run /security-review on the branch before merge (repo pre-commit gate).
• Optional: a lightweight CI check/grep flagging new handlers that read a *_id path/query/body param without invoking the helper.

Definition of Done

• All cross-user access tests green in CI.
• PR template updated.
• /security-review re-run shows no remaining broken-access-control findings.

Affected files

.github/PULL_REQUEST_TEMPLATE.md, test suite, CI workflow (optional)

[franciszver]

Done and merged to main in PR #66 (part of epic #59).