Stop task logs and contributor pages leaking to people who shouldn't see them

[doomlab]

Addresses #539 (someone else's results visible on a contributor page). Review the rules below: this is a behaviour change on the server.

Problem

getTaskLogs and getContributor only checked that you were signed in. The filter came straight from the browser, so any signed-in user could ask for any task log (including form responses) in any project, and open any contributor page by changing the number in the URL. The app's intent is already visible in the UI: a contributor's contributors list is filtered down to themselves in the browser, after the server has sent everyone. The server never enforced it.

Rules

getTaskLogs

• The browser's filter is always narrowed to projects the user belongs to (any role). Other projects return nothing.
• Form responses (metadata) are kept for project managers of the project, and for logs assigned to the user or to a team they are on. For everyone else's logs in the project the response is blanked (null). Status, approval, dates and who completed it are still returned, so summaries and counts (e.g. the milestone summary, which counts every assignee's logs) keep working.

getContributor (now takes projectId; its one caller, useContributorData, passes it)

• The user must belong to the project, and the contributor must belong to that project (before, any member id from any project could be opened).
• Project managers can open anyone in the project. Everyone else can open themselves and people on a team with them (the pages the app already links them to from team pages). Anything else is reported as not found.

Not covered

Other queries have the same pattern of trusting the browser's filter (e.g. getComments, getProjectMember, getTasks). This only covers task logs and the contributor lookup; I'd treat the rest as a follow-up audit.

Testing

13 new tests with the database mocked: the filter is narrowed (and applies to the count and to paged results), managers keep responses, others' responses are blanked while own and team responses are kept, outsiders get nothing, and each contributor-lookup case above. 8 of them fail against the old code. Typecheck (apart from the existing getJsonSchema.test.ts errors), lint and the full suite pass. Not yet checked in the app: please try as a project manager and as a contributor: the contributor page, a team page, the milestone summary and the dashboard widgets.

🤖 Generated with Claude Code