security: round 2 — multi-tenancy isolation (OrganisationScope, scoped validation, boundary checks)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

api/app/Models/TimeSlot.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Models;
 
+use App\Models\Scopes\OrganisationScope;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Concerns\HasUlids;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -17,6 +18,14 @@ final class TimeSlot extends Model
     use HasFactory;
     use HasUlids;
 
+    /** @var string Used by OrganisationScope to determine filtering strategy */
+    public string $organisationScopeColumn = 'event_id';
+
+    protected static function booted(): void
+    {
+        static::addGlobalScope(new OrganisationScope());
+    }
+
     protected $fillable = [
         'event_id',
         'name',