fix(security): enforce multi-tenant task search scoping and personal task authorization

[shashankch]

• Extract currentUserId from @AuthenticationPrincipal Jwt in TaskController.searchTasks
• Scope global task search to user's member teams and personal tasks at database specification level
• Enforce team membership validation on explicit team queries (teamId != null) returning 403 Forbidden for non-members
• Enforce personal task access boundaries across TaskService (read, update, status transition, assignment, deletion)
• Extend parity personal task access validation across TaskCommentService, TaskAttachmentService, and AiAssistantService
• Remove unauthenticated getTaskById(UUID taskId) overload from TaskService
• Add findTeamIdsByUserId port and JPA adapter query in team module
• Expand negative authorization test suites across unit, controller, and integration layers asserting 403 Forbidden
• Add ADR 0009 documenting multi-tenant authorization architecture and create docs/adr/README.md index
• Add STRIDE threat model analysis, IAM endpoint policy matrix, and future phase architecture to docs/architecture.md
• Synchronize README badges, Mermaid diagrams, API specifications, and roadmap with 2026 production standards