fix(security): enforce company scope on notes, estimate-convert, and user bulk-delete (#661)

- Notes IDOR (GHSA-85wc): NotePolicy::viewNotes/manageNotes now receive the
  Note and require hasCompany($note->company_id); NotesController passes the
  bound model to authorize() on show/update/destroy.
- Estimate->Invoice IDOR (GHSA-j2vg): ConvertEstimateController authorizes
  'view' on the source estimate before creating the invoice.
- User bulk-delete (GHSA-wxrv): UsersController scopes candidate ids via
  User::whereCompany() before deletion so cross-company accounts are protected.

Adds feature tests for cross-company 403s plus same-company happy paths.

app/Http/Controllers/V1/Admin/Estimate/ConvertEstimateController.php

@@ -23,6 +23,10 @@ class ConvertEstimateController extends Controller
      */
     public function __invoke(Request $request, Estimate $estimate, Invoice $invoice)
     {
+        // Authorize access to the source estimate (tenant isolation) in addition
+        // to the ability to create an invoice — otherwise any estimate id from
+        // another company could be converted and disclosed.
+        $this->authorize('view', $estimate);
         $this->authorize('create', Invoice::class);
 
         $estimate->load(['items', 'items.taxes', 'customer', 'taxes']);

app/Http/Controllers/V1/Admin/General/NotesController.php

@@ -61,7 +61,7 @@ class NotesController extends Controller
      */
     public function show(Note $note)
     {
-        $this->authorize('view notes');
+        $this->authorize('view notes', $note);
 
         return new NoteResource($note);
     }
@@ -74,7 +74,7 @@ class NotesController extends Controller
      */
     public function update(NotesRequest $request, Note $note)
     {
-        $this->authorize('manage notes');
+        $this->authorize('manage notes', $note);
 
         $note->update($request->getNotesPayload());
 
@@ -97,7 +97,7 @@ class NotesController extends Controller
      */
     public function destroy(Note $note)
     {
-        $this->authorize('manage notes');
+        $this->authorize('manage notes', $note);
 
         $note->delete();
 

app/Http/Controllers/V1/Admin/Users/UsersController.php

@@ -90,7 +90,16 @@ class UsersController extends Controller
         $this->authorize('delete multiple users', User::class);
 
         if ($request->users) {
-            User::deleteUsers($request->users);
+            // Scope the candidate ids to members of the acting company so a user
+            // from one company cannot delete accounts belonging to another.
+            $ids = User::whereCompany()
+                ->whereIn('id', $request->users)
+                ->pluck('id')
+                ->toArray();
+
+            if ($ids) {
+                User::deleteUsers($ids);
+            }
         }
 
         return response()->json([