Security fix: resolves broken access control / IDOR in Team, Project, and Task modules.
Scoped permissions such as team.manage-members, project.manage-members, and task.assign are no longer treated as global access permissions. The update adds explicit global permissions team.view-all, project.view-all, and task.view-all, and enforces record-level ownership checks for scoped users.
Upgrade step:
php artisan migrate