Authorization - cross-org access blocked

Every Task and Project endpoint must verify the requesting user belongs to the resource's org. Write a test proving cross-org access is blocked. This is your first security-relevant test.

The single defining bug class of multi-tenant systems, and it does not announce itself: everything works perfectly while you test with one tenant. The verifier creates two orgs and tries to cross the boundary, which is the only way to find out.