fix(security): enforce generic resource ownership and lifecycle boundaries #28

Follow-up to #22 identified remaining generic-resource ownership gaps. Treat this as a release blocker; first iteration did not claim complete tenant isolation.

Scope:

• Make supported generic resource roots and their ownership explicit; do not derive authorization from UI metadata registration.
• Keep ledger/lifecycle child mutations behind dedicated business APIs.
• Validate scalar foreign-key ownership after hooks, including safe handling of update operations and documented shared materials.
• Protect relationship reads for pre-existing invalid links, with a read-only inventory/repair plan.

Acceptance: authorized same-company master-data workflows continue to work; foreign-company references and unsupported child access are refused for list/detail/count/create/update/delete and nested projections. Cover hook output and optional/global reference policy. No invented accounting rules or arbitrary ownership traversal. Independent review and real PostgreSQL regression evidence required.

Implementation should be isolated from supplier posting and first-company UX changes. Do not describe the product as production-ready until this and the deployment/business gates are resolved.