fix(security): gate background-migrations behind adminProcedure + scope project lookup to orgId

- background-migrations all/status: require admin role (was any authenticated user)
- projectsRouter: add orgId filter on project lookup to prevent cross-org access

web/src/features/background-migrations/server/background-migrations-router.ts

@@ -13,7 +13,7 @@ const denyOnHanzoCloud = () => {
 };
 
 export const backgroundMigrationsRouter = createTRPCRouter({
-  all: authenticatedProcedure.query(async ({ ctx }) => {
+  all: adminProcedure.query(async ({ ctx }) => {
     denyOnHanzoCloud();
     const backgroundMigrations = await ctx.prisma.backgroundMigration.findMany({
       orderBy: {
@@ -23,7 +23,7 @@ export const backgroundMigrationsRouter = createTRPCRouter({
 
     return { migrations: backgroundMigrations };
   }),
-  status: authenticatedProcedure.query(async ({ ctx }) => {
+  status: adminProcedure.query(async ({ ctx }) => {
     denyOnHanzoCloud();
     const backgroundMigrations = await ctx.prisma.backgroundMigration.findMany({
       orderBy: {

web/src/features/projects/server/projectsRouter.ts

@@ -232,6 +232,7 @@ export const projectsRouter = createTRPCRouter({
       const project = await ctx.prisma.project.findUnique({
         where: {
           id: input.projectId,
+          orgId: ctx.session.orgId,
           deletedAt: null,
         },
       });