fix(security): enforce company scope on notes, doc-convert, and member bulk-delete (#668)

v3 port of the v2 authorization fixes.

- Notes IDOR (GHSA-85wc): NotePolicy checks the note's company_id and
  NotesController passes the bound model to authorize() on show/update/destroy.
- Estimate<->Invoice convert IDOR (GHSA-j2vg): EstimatesController::convertToInvoice
  and InvoicesController::convertToEstimate authorize 'view' on the source
  document before creating the target.
- Member bulk-delete (GHSA-wxrv): MembersController scopes ids via
  User::whereCompany() before MemberService::delete.

Adds feature tests for cross-company 403s + same-company happy paths.

app/Http/Controllers/Company/Estimate/EstimatesController.php

@@ -121,6 +121,9 @@ class EstimatesController extends Controller
 
     public function convertToInvoice(Request $request, Estimate $estimate)
     {
+        // Authorize access to the source estimate (tenant isolation) in addition
+        // to the ability to create an invoice.
+        $this->authorize('view', $estimate);
         $this->authorize('create', Invoice::class);
 
         $invoice = $this->estimateService->convertToInvoice($estimate);

app/Http/Controllers/Company/General/NotesController.php

@@ -61,7 +61,7 @@ class NotesController extends Controller
      */
     public function show(Note $note)
     {
-        $this->authorize('view notes');
+        $this->authorize('view notes', $note);
 
         return new NoteResource($note);
     }
@@ -74,7 +74,7 @@ class NotesController extends Controller
      */
     public function update(NotesRequest $request, Note $note)
     {
-        $this->authorize('manage notes');
+        $this->authorize('manage notes', $note);
 
         $note->update($request->getNotesPayload());
 
@@ -97,7 +97,7 @@ class NotesController extends Controller
      */
     public function destroy(Note $note)
     {
-        $this->authorize('manage notes');
+        $this->authorize('manage notes', $note);
 
         $note->delete();
 

app/Http/Controllers/Company/Invoice/InvoicesController.php

@@ -151,6 +151,9 @@ class InvoicesController extends Controller
 
     public function convertToEstimate(Request $request, Invoice $invoice)
     {
+        // Authorize access to the source invoice (tenant isolation) in addition
+        // to the ability to create an estimate.
+        $this->authorize('view', $invoice);
         $this->authorize('create', Estimate::class);
 
         $estimate = $this->invoiceService->convertToEstimate($invoice);

app/Http/Controllers/Company/Members/MembersController.php

@@ -93,7 +93,16 @@ class MembersController extends Controller
         $this->authorize('delete multiple users', User::class);
 
         if ($request->users) {
-            $this->memberService->delete($request->users);
+            // Scope the candidate ids to members of the acting company so a user
+            // from one company cannot delete accounts belonging to another.
+            $ids = User::whereCompany()
+                ->whereIn('id', $request->users)
+                ->pluck('id')
+                ->toArray();
+
+            if ($ids) {
+                $this->memberService->delete($ids);
+            }
         }
 
         return response()->json([