fix: uplift testing, tighten auth policies, fix stale CRUD endpoints

[emilylm]

📌 Summary

This PR tightens authorization on previously under-protected API routes and aligns several live CRUD endpoints with the current SQLAlchemy models. A number of mounted endpoints were still using stale request/response schemas or update logic from older data shapes, which caused broken writes, incorrect response validation, and silent no-op updates. This change makes the live API contract match the current backend data model and adds regression coverage around the repaired paths.

---

🔄 Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to change)
• 🧹 Refactor (code change that neither fixes a bug nor adds a feature)
• 📚 Documentation update
• ⚙️ CI / build / tooling change

---

🧩 Key Changes

• Tightened auth/policy enforcement for previously exposed users admin endpoints and broker operational/reporting endpoints.
• Fixed stale CRUD schemas and update behaviour for projects, samples, experiments, reads, sample-submissions, and assemblies so they match the live DB models.
• Added regression tests for auth enforcement, schema/model alignment, legacy compatibility handling, and repaired submission/update flows.

---

✅ Checklist

• Tests are passing locally / in CI
• New tests have been added for new or changed functionality
• Self-review completed
• Documentation updated (if needed)
• No sensitive data or secrets included

---

🔍 Review Notes

• sample-submissions now derives project_id server-side from the sample’s genomic_data project instead of trusting client input, to keep submission prerequisites internally consistent.

---

📎 Related Issues / Tickets

• Closes #
• Related to #

---