fix(security): enforce company scope on notes, doc-convert, and member bulk-delete (#668)

v3 port of the v2 authorization fixes.

- Notes IDOR (GHSA-85wc): NotePolicy checks the note's company_id and
  NotesController passes the bound model to authorize() on show/update/destroy.
- Estimate<->Invoice convert IDOR (GHSA-j2vg): EstimatesController::convertToInvoice
  and InvoicesController::convertToEstimate authorize 'view' on the source
  document before creating the target.
- Member bulk-delete (GHSA-wxrv): MembersController scopes ids via
  User::whereCompany() before MemberService::delete.

Adds feature tests for cross-company 403s + same-company happy paths.

app/Http/Controllers/Company/Estimate/EstimatesController.php

@@ -121,6 +121,9 @@ class EstimatesController extends Controller
 
     public function convertToInvoice(Request $request, Estimate $estimate)
     {
+        // Authorize access to the source estimate (tenant isolation) in addition
+        // to the ability to create an invoice.
+        $this->authorize('view', $estimate);
         $this->authorize('create', Invoice::class);
 
         $invoice = $this->estimateService->convertToInvoice($estimate);