fix(PROJ-63): Defense-in-Depth Tenant-Scope-Härtung der Admin-Endpunkte

tenantAccessAllowed()-Check in allen {id}-Handlern von tenant_handlers.go,
tenant_domain_handlers.go und tenant_logo_handlers.go ergänzt — No-op für
globale Admins, zweite Verteidigungslinie für hypothetische tenant-gebundene
Admin-Sessions.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/api/tenant_logo_handlers.go

@@ -57,6 +57,11 @@ func (s *Server) handleUploadTenantLogo(w http.ResponseWriter, r *http.Request)
 		writeError(w, http.StatusBadRequest, "invalid tenant id")
 		return
 	}
+	// Defense-in-depth tenant scope check (PROJ-63): no-op for global admins.
+	if !tenantAccessAllowed(sessionFromCtx(r.Context()), &id) {
+		writeError(w, http.StatusForbidden, "access denied")
+		return
+	}
 	s.saveTenantLogo(w, r, id)
 }
 
@@ -70,6 +75,11 @@ func (s *Server) handleDeleteTenantLogo(w http.ResponseWriter, r *http.Request)
 		writeError(w, http.StatusBadRequest, "invalid tenant id")
 		return
 	}
+	// Defense-in-depth tenant scope check (PROJ-63): no-op for global admins.
+	if !tenantAccessAllowed(sessionFromCtx(r.Context()), &id) {
+		writeError(w, http.StatusForbidden, "access denied")
+		return
+	}
 	if err := s.tenantStore.DeleteLogo(r.Context(), id); err != nil {
 		writeError(w, http.StatusInternalServerError, "failed to delete logo")
 		return