fix(security): enforce multi-tenant task search scoping and personal task authorization - #9

…task authorization

- Extract currentUserId from @AuthenticationPrincipal Jwt in TaskController.searchTasks
- Scope global task search to user's member teams and personal tasks at database specification level
- Enforce team membership validation on explicit team queries (teamId != null) returning 403 Forbidden for non-members
- Enforce personal task access boundaries across TaskService (read, update, status transition, assignment, deletion)
- Extend parity personal task access validation across TaskCommentService, TaskAttachmentService, and AiAssistantService
- Remove unauthenticated getTaskById(UUID taskId) overload from TaskService
- Add findTeamIdsByUserId port and JPA adapter query in team module
- Expand negative authorization test suites across unit, controller, and integration layers asserting 403 Forbidden
- Add ADR 0009 documenting multi-tenant authorization architecture and create docs/adr/README.md index
- Add STRIDE threat model analysis, IAM endpoint policy matrix, and future phase architecture to docs/architecture.md
- Synchronize README badges, Mermaid diagrams, API specifications, and roadmap with 2026 production standards