security: round 2 — multi-tenancy isolation (OrganisationScope, scoped validation, boundary checks)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

api/tests/Feature/Event/FestivalEventTest.php

@@ -550,9 +550,9 @@ class FestivalEventTest extends TestCase
             'allow_overlap' => false,
         ]);
 
-        // Create a person
+        // Create a person (on festival level, per schema design)
         $person = Person::factory()->create([
-            'event_id' => $this->subEvent->id,
+            'event_id' => $this->festival->id,
             'crowd_type_id' => $this->crowdType->id,
         ]);