sec(api): planned-purchase pause/resume ignore the update-any permission's Constraints #1098

Found while fixing #961 (PR #1097).

POST /api/purchases/planned/{id}/pause and .../resume accept update-any without checking that permission's Constraints (provider, service, region, account). A session whose update-any is limited to one provider can therefore pause or resume scheduled purchases for any provider or account.

/run already re-checks execute Constraints before buying (#1036). #1097 fixes the same gap on DELETE with authorizePlannedFullScope, which tries update-any and then cancel-any against the stored row and fails closed on any lookup error.

Suggested fix: route pause and resume through the same row-scoped check, with deny and allow tests for each constraint dimension. #1097's handler_purchases_planned_update_any_test.go can serve as the template.