sec(api): owner-vs-key HasPermissionAPI on remaining purchase authz helpers #1005

Follow-up recommended in the independent review of #1001 (issue #979).

#1001 moves the planned-purchase helpers (authorizePlannedPurchaseCancel and authorizeExecutionManagement) from HasPermissionAPI(ctx, session.UserID, …) to sessionHoldsVerb (handler_purchases.go:519). For API-key sessions, sessionHoldsVerb checks the key's effective permissions. The same owner-instead-of-key *-any probe is still used in these places (line numbers as reported at fe70fbb):

• handler_purchases.go:
  • approve: :1072/:1080 and :1121/:1128
  • execute: :1418/:1426
  • cancel, other path: :1951/:1970
  • retry: :2535/:2543
• handler_purchases_revoke.go: revoke at :314/:326 and :415/:427
• handler_ri_exchange.go: approve at :2429/:2436 and :2463/:2471

The route-level gates (handler.go:313/:423) already branch to the key path, at :338/:445.

On these paths, a narrowly scoped API key is judged by its owner's *-any grants. Some of them are backstopped by key-scoped Constraints checks, and some may not be. Each site should either switch to sessionHoldsVerb or document why the owner check is intended. Each needs a regression test through HandleRequest: a narrow key on another user's row is refused, and the owner's session still works.

🤖 Generated with Claude Code