fix(security): enforce company scope on notes, doc-convert, and member bulk-delete (#668)

v3 port of the v2 authorization fixes.

- Notes IDOR (GHSA-85wc): NotePolicy checks the note's company_id and
  NotesController passes the bound model to authorize() on show/update/destroy.
- Estimate<->Invoice convert IDOR (GHSA-j2vg): EstimatesController::convertToInvoice
  and InvoicesController::convertToEstimate authorize 'view' on the source
  document before creating the target.
- Member bulk-delete (GHSA-wxrv): MembersController scopes ids via
  User::whereCompany() before MemberService::delete.

Adds feature tests for cross-company 403s + same-company happy paths.

tests/Feature/Admin/InvoiceTest.php

@@ -3,6 +3,7 @@
 use App\Http\Controllers\Company\Invoice\InvoicesController;
 use App\Http\Requests\InvoicesRequest;
 use App\Mail\SendInvoiceMail;
+use App\Models\Company;
 use App\Models\Invoice;
 use App\Models\InvoiceItem;
 use App\Models\Tax;
@@ -34,6 +35,12 @@ test('testGetInvoices', function () {
     $response->assertOk();
 });
 
+test('cannot convert an invoice belonging to another company', function () {
+    $invoice = Invoice::factory()->create(['company_id' => Company::factory()->create()->id]);
+
+    postJson("api/v1/invoices/{$invoice->id}/convert-to-estimate")->assertStatus(403);
+});
+
 test('create invoice', function () {
     $invoice = Invoice::factory()
         ->raw([