case 4712 - customer contacts work only with their own service requests and units

Step 3 of 4712 (security review F14). The Customer role has change rights on
service requests and nothing checked whose they were. For customer contacts:
another customer's request is not found (read, update, delete); creating or
moving a request to a customer the contact does not own is refused (403); a
contact's request is always requested by that contact. unit/customerunit adds
units only to the contact's own customer (or one of its head office's).

Checked: another customer's request 404 (was 200), create for another customer
403, own request created and deleted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/AyaNova/Controllers/UnitController.cs

@@ -80,6 +80,9 @@ namespace AyaNova.Api.Controllers
 
             if (!ModelState.IsValid)
                 return BadRequest(new ApiErrorResponse(ModelState));
+            //case 4712: a contact adds units only to its own customer (or, head office contact, one of its customers)
+            if (!await UserBiz.CustomerContactOwnsCustomerAsync(ct, biz.UserId, newObject.CustomerId))
+                return StatusCode(403, new ApiNotAuthorizedResponse());
             long? o = await biz.CustomerCreateAsync(newObject);
             if (o == null)
                 return BadRequest(new ApiErrorResponse(biz.Errors));