fix(trash): owner-scope all trash ops — close cross-tenant IDOR/disclosure

Drift-audit Group 1 (authz/IDOR). Multi-user is live, so these were
exploitable ACL bypasses:

- trash.py: add _owner_clause() and apply it to _exists_alive, restore,
  purge, list_trash, and purge_expired. A batch_id is a bearer token;
  without an owner predicate a leaked/guessed id let one tenant read
  (list_trash), restore, or PERMANENTLY purge another's content. Topics
  and rules carried no owner check at all (_OWNER mapped them to None) —
  ownership now derives through the parent rulebook (or owning project,
  for project-scoped rules).
- purge_expired is now per-user; trash_scheduler iterates every user and
  applies that user's own trash_retention_days window, instead of
  applying user 1's window to everyone (early data loss for other users).
- rulebooks subscribe/unsubscribe_project now assert project ownership,
  matching the suppression endpoints.
- topic/rule DELETE routes return 404 when nothing owned was removed.

Regression test locks in that every model — including topics/rules —
gets a real owner clause.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/fabledassistant/services/rulebooks.py

@@ -498,6 +498,7 @@ async def subscribe_project(
     from fabledassistant.models.rulebook import project_rulebook_subscriptions
 
     async with async_session() as session:
+        await _assert_project_owned(session, project_id, user_id)
         await _assert_rulebook_owned(session, rulebook_id, user_id)
         # ON CONFLICT DO NOTHING via try/except to keep dialect-agnostic.
         try:
@@ -517,6 +518,7 @@ async def unsubscribe_project(
     from fabledassistant.models.rulebook import project_rulebook_subscriptions
 
     async with async_session() as session:
+        await _assert_project_owned(session, project_id, user_id)
         await _assert_rulebook_owned(session, rulebook_id, user_id)
         await session.execute(
             sql_delete(project_rulebook_subscriptions).where(