feat(api): RequireAuth+RequireProjectAccess middleware, IDOR-scope check/apply по projectID

internal/store/db/domains.sql.go

@@ -162,9 +162,14 @@ SELECT d.zone_id, a.provider, a.secret_enc, t.doc
 FROM domains d
 JOIN provider_accounts a ON a.id = d.provider_account_id
 LEFT JOIN templates t ON t.id = d.template_id
-WHERE d.id = $1
+WHERE d.id = $1 AND d.project_id = $2
 `
 
+type LoadDomainFullParams struct {
+	ID        uuid.UUID `json:"id"`
+	ProjectID uuid.UUID `json:"project_id"`
+}
+
 type LoadDomainFullRow struct {
 	ZoneID    string           `json:"zone_id"`
 	Provider  string           `json:"provider"`
@@ -172,8 +177,8 @@ type LoadDomainFullRow struct {
 	Doc       *dto.TemplateDoc `json:"doc"`
 }
 
-func (q *Queries) LoadDomainFull(ctx context.Context, id uuid.UUID) (LoadDomainFullRow, error) {
-	row := q.db.QueryRow(ctx, loadDomainFull, id)
+func (q *Queries) LoadDomainFull(ctx context.Context, arg LoadDomainFullParams) (LoadDomainFullRow, error) {
+	row := q.db.QueryRow(ctx, loadDomainFull, arg.ID, arg.ProjectID)
 	var i LoadDomainFullRow
 	err := row.Scan(
 		&i.ZoneID,