test(authz): add source-scoped authorization coverage

[alucero270]

test(authz): add source-scoped authorization coverage

Summary

Add automated coverage for source-scoped authorization so access control is enforced reliably across APIs and retrieval.

Scope

• Files: authorization tests, fixtures, verification docs as needed
• Components: source-scoped authorization, retrieval filtering, API permission checks

Acceptance Criteria

• tests cover access allowed and access denied scenarios by source scope
• tests cover retrieval filtering for unauthorized content
• tests pass in a documented verification flow

Notes

• These tests protect the product's access-control trust boundary