Harden Core Issue Loop access control

[mrboxs]

This was generated by AI during triage.

What to build

Harden the Core Issue Loop access-control boundary so every protected route and oRPC procedure enforces Workspace membership and Team/Issue ownership consistently.

This slice should introduce or consolidate shared domain policy helpers in the app layer, matching ADR 0001 while keeping Private Team behavior deferred from this PRD. It must include the new Workspace Creation and Welcome Flow surfaces so cross-workspace setup routes are authorization-safe.

Acceptance criteria

• Shared policy helpers cover Core Issue Loop checks for viewing Workspace data, viewing Team data, viewing Issues, creating Issues in a Team, assigning Issues, and updating Issue status.
• Every Core Issue Loop protected oRPC procedure requires an authenticated session.
• Every Core Issue Loop read/write verifies Workspace membership before returning Workspace, Team, Workflow Status, or Issue data.
• /:workspaceSlug/welcome is accessible only to Workspace Members of that Workspace.
• Cross-workspace access to /:workspaceSlug/welcome and Team pages returns authorization-safe errors.
• Public Team Issues are visible to Workspace Members.
• Cross-workspace Issue reads and writes return authorization-safe errors.
• workspaceSlug, teamKey, issueKey, and submitted IDs are resolved server-side before use.
• Assignee changes cannot target users outside the Workspace.
• Status changes cannot target Workflow Statuses outside the Issue's Team.
• Private Team behavior remains out of scope, but policy names and boundaries do not block adding it later.
• Focused tests cover unauthenticated rejection, cross-workspace denial, wrong-Team issue key denial, invalid assignee denial, invalid Workflow Status denial, and cross-workspace Welcome denial.

Blocked by

• Open an Issue through its canonical Team route #46
• Edit core Issue properties from detail #47
• Filter the Team issue list by Workflow Status and assignee #48
• Complete the Welcome Flow and land on the active Team page #51

[linear-code]

BOXS-50