Improve permissions checking

[epugh]

Description

We need to scope lookups for data to who owns it instead of using :id directly.

Motivation and Context

Better security

How Has This Been Tested?

manual and tests

Types of changes

• [] Bug fix (non-breaking change which fixes an issue)
• Improvement (non-breaking change which improves existing functionality)
• [] New feature (non-breaking change which adds new functionality)
• [] Breaking change (fix or feature that would cause existing functionality to change)

[Copilot]

Pull request overview

This PR tightens authorization by scoping record lookups to the current user (or the current book/team) instead of fetching by raw :id, reducing the chance of unauthorized access via ID guessing.

Changes:

• Scope Team, ApiKey, Judgement, and QueryDocPair lookups through current_user / @book.
• Scope API “share” endpoints to cases/scorers the current user is involved with, returning 404 when inaccessible.
• Add/adjust tests to cover the new authorization behavior and reduce noisy output/flaky external LLM behavior.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/services/llm_service_test.rb	Removes debug output; makes the Ollama test conditional on reachability and ensures WebMock is restored.
test/controllers/teams_controller_test.rb	Switches fixture user and adds coverage for non-member access/rename attempts.
test/controllers/api_keys_controller_test.rb	Adds integration tests ensuring users can only delete their own API keys.
test/controllers/api/v1/team_scorers_controller_test.rb	Adds a not-found test when sharing an inaccessible scorer.
test/controllers/api/v1/team_cases_controller_test.rb	Adds a not-found test when sharing an inaccessible case.
app/controllers/teams_controller.rb	Scopes set_team to current_user.teams.
app/controllers/query_doc_pairs_controller.rb	Reorders callbacks and scopes query-doc-pair lookup via @book.
app/controllers/judgements_controller.rb	Reorders callbacks and scopes judgement lookup via @book.
app/controllers/api_keys_controller.rb	Scopes API key deletion via current_user.api_keys.
app/controllers/api/v1/team_scorers_controller.rb	Scopes scorer lookup via current_user.scorers_involved_with.
app/controllers/api/v1/team_cases_controller.rb	Scopes case lookup via current_user.cases_involved_with (with includes).
app/controllers/ai_judges_controller.rb	Scopes team and AI-judge lookups through current_user.teams and @team.members.only_ai_judges.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.