Security: texture validation doesn't enforce per-user entitlement

[BAWES]

Description

resolveTextureUrls() and resolveCompanionTexture() in lib/avatar-catalog-validator.ts validate texture existence in active scoped sets but do not enforce per-user access rules (visibility, policies, grants). Crafted texture IDs could pass room-access validation even when the user shouldn't have access.

Location

lib/avatar-catalog-validator.ts lines ~35, ~60-76, ~136-142, ~167-176

Suggested Fix

Extend resolver signatures to accept user context (userId, membershipTags) and constrain DB queries to sets the user is actually entitled to.

Priority

Medium — requires architectural work, no known exploit

[massmarketconsumer-arch]

I have submitted a complete fix for this issue in #182 (#182). Resolves texture and companion entitlement enforcement across public, hidden, assigned_only, and restricted sets with comprehensive unit tests (112/112 tests passing).