fix(trash): owner-scope all trash ops — close cross-tenant IDOR/disclosure

Drift-audit Group 1 (authz/IDOR). Multi-user is live, so these were
exploitable ACL bypasses:

- trash.py: add _owner_clause() and apply it to _exists_alive, restore,
  purge, list_trash, and purge_expired. A batch_id is a bearer token;
  without an owner predicate a leaked/guessed id let one tenant read
  (list_trash), restore, or PERMANENTLY purge another's content. Topics
  and rules carried no owner check at all (_OWNER mapped them to None) —
  ownership now derives through the parent rulebook (or owning project,
  for project-scoped rules).
- purge_expired is now per-user; trash_scheduler iterates every user and
  applies that user's own trash_retention_days window, instead of
  applying user 1's window to everyone (early data loss for other users).
- rulebooks subscribe/unsubscribe_project now assert project ownership,
  matching the suppression endpoints.
- topic/rule DELETE routes return 404 when nothing owned was removed.

Regression test locks in that every model — including topics/rules —
gets a real owner clause.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/fabledassistant/services/trash_scheduler.py

@@ -1,9 +1,9 @@
 """Daily APScheduler cron that purges expired trash.
 
 Mirrors version_pinning_scheduler.py: a single global BackgroundScheduler job
-at 03:30 UTC bridges into the asyncio loop to run the async purge. Reads the
-operator's `trash_retention_days` setting (single-tenant: user 1); 0 disables
-auto-purge.
+at 03:30 UTC bridges into the asyncio loop to run the async purge. Iterates
+every user and applies that user's own `trash_retention_days` setting; 0
+disables auto-purge for that user.
 """
 from __future__ import annotations
 
@@ -30,12 +30,22 @@ def _run_purge_threadsafe() -> None:
 
     async def _runner():
         try:
-            raw = await get_setting(1, "trash_retention_days", "90")
-            try:
-                days = int(raw)
-            except (TypeError, ValueError):
-                days = 90
-            purged = await trash_svc.purge_expired(days)
+            from sqlalchemy import select
+
+            from fabledassistant.models import async_session
+            from fabledassistant.models.user import User
+
+            async with async_session() as session:
+                user_ids = (await session.execute(select(User.id))).scalars().all()
+
+            purged = 0
+            for uid in user_ids:
+                raw = await get_setting(uid, "trash_retention_days", "90")
+                try:
+                    days = int(raw)
+                except (TypeError, ValueError):
+                    days = 90
+                purged += await trash_svc.purge_expired(uid, days)
             if purged:
                 logger.info("trash purge: removed %d expired row(s)", purged)
             else: