security: round 2 — multi-tenancy isolation (OrganisationScope, scoped validation, boundary checks)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

api/app/Http/Controllers/Api/V1/InvitationController.php

@@ -75,6 +75,11 @@ final class InvitationController extends Controller
 
     public function revoke(Organisation $organisation, UserInvitation $invitation): JsonResponse
     {
+        // Verify invitation belongs to this organisation
+        if ($invitation->organisation_id !== $organisation->id) {
+            return $this->notFound('Uitnodiging niet gevonden');
+        }
+
         Gate::authorize('invite', $organisation);
 
         if (! $invitation->isPending()) {