security: round 2 — multi-tenancy isolation (OrganisationScope, scoped validation, boundary checks)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

api/app/Policies/ShiftAssignmentPolicy.php

@@ -18,16 +18,28 @@ final class ShiftAssignmentPolicy
 
     public function approve(User $user, ShiftAssignment $assignment, Event $event): bool
     {
+        if ($assignment->shift->festivalSection->event_id !== $event->id) {
+            return false;
+        }
+
         return $this->canManageEvent($user, $event);
     }
 
     public function reject(User $user, ShiftAssignment $assignment, Event $event): bool
     {
+        if ($assignment->shift->festivalSection->event_id !== $event->id) {
+            return false;
+        }
+
         return $this->canManageEvent($user, $event);
     }
 
     public function cancel(User $user, ShiftAssignment $assignment, Event $event): bool
     {
+        if ($assignment->shift->festivalSection->event_id !== $event->id) {
+            return false;
+        }
+
         if ($this->canManageEvent($user, $event)) {
             return true;
         }