fix: complete audit security and frontend gaps

backend/internal/projects/service_test.go

@@ -41,13 +41,24 @@ func TestDashboardCountsOnlyRequestedProject(t *testing.T) {
 	require.NoError(t, database.Create(&domain.Task{ProjectID: first.ID, CreatedBy: 1, Title: "A", Status: "open"}).Error)
 	require.NoError(t, database.Create(&domain.Task{ProjectID: second.ID, CreatedBy: 1, Title: "B", Status: "open"}).Error)
 
-	dashboard, err := service.Dashboard(first.ID)
+	dashboard, err := service.Dashboard(1, first.ID)
 
 	require.NoError(t, err)
 	require.Equal(t, int64(1), dashboard.PendingInboxCount)
 	require.Equal(t, int64(1), dashboard.OpenTaskCount)
 }
 
+func TestDashboardRejectsProjectOwnedByAnotherUser(t *testing.T) {
+	database := newTestDB(t)
+	service := NewService(database)
+	project, err := service.CreateProject(2, "Beta", "")
+	require.NoError(t, err)
+
+	_, err = service.Dashboard(1, project.ID)
+
+	require.Error(t, err)
+}
+
 func newTestDB(t *testing.T) *gorm.DB {
 	t.Helper()
 	database, err := gorm.Open(sqlite.Open(fmt.Sprintf("file:%s?mode=memory&cache=shared", t.Name())), &gorm.Config{})