fix(backend): enforce position ownership on every read and mutation path

[arisu6804]

Problem

Ownership checks are easy to bypass when callers reach a secondary read or mutation path using a guessed position identifier.

Objective

Deliver a production-quality improvement to position controllers, services, and routes that creates measurable value for correctness, security, reliability, performance, or maintainability.

Implementation scope

• Centralize authorization at the service boundary rather than relying only on route handlers.
• Apply the same policy to list, detail, deposit, withdrawal, and administrative lookup paths.
• Return indistinguishable not-found or forbidden behavior that does not enumerate another account's positions.

Acceptance criteria

• A user cannot read or mutate any position they do not own.
• All position access paths use the same authorization policy.
• Regression tests cover direct IDs, list filters, malformed identifiers, and privileged-role behavior.

Required validation

• Authorization matrix tests and API integration tests for owner, unrelated user, and authorized operator.
• Existing tests and CI remain passing.
• Add regression coverage for the original failure mode.
• Do not weaken, delete, or skip unrelated tests to obtain a green build.

PR quality bar

• Keep the PR focused on this issue and explain design tradeoffs.
• Include test evidence, compatibility impact, and migration or rollout notes where relevant.
• Avoid typo-only, documentation-only, cosmetic-only, or unrelated refactor submissions.

Out of scope

• Broad rewrites not required by the acceptance criteria.
• Changes to unrelated services, contracts, or user flows.