Cross-tenant permissions hardening

Closed a class of bugs in the Strategist API where some endpoints accepted a brand or strategy ID without verifying it belonged to the caller's organization. The fix returns 404 Not Found in those cases — no information is leaked about which IDs exist in other workspaces.

Patched routes: every brand-scoped endpoint in the calendar, catalog, and document-list services. A broader audit + centralized enforcement primitive lands in the next release window.