An authenticated user with no resolvable team (rare — a signup whose personal
team creation failed and never healed, since later logins don't re-ensure it)
resolved to a null team, and PolicyAccessGuard/SourceAccessGuard passed that
null straight through: findByTeam(null) and Objects.equals(teamId, null) match
the shared unteamed bucket, so two such users would see and edit each other's
policies and sources. Add PolicyManagementAuthority.requireCurrentUserTeamId()
(401s on an unresolved team) and use it in both guards' enforced paths, so an
unteamed caller is rejected rather than silently sharing that bucket. Scoping
for properly-teamed users is unchanged.
EthanHealy01
75464f453d