Confine trust center reads and signatures to the page's tenant

The public trust API derived its authorization scope from client-supplied
global IDs, so a visitor on one trust center could resolve nodes, export
audit-report PDFs, and read or mutate electronic signatures belonging to
another organization (cross-tenant access).

Every trust API resolver now derives its scope from the active compliance
page's organization via compliancepage.ScopeFromContext, so reads are always
confined to the page's tenant. Cross-tenant or unknown IDs surface as
not-found instead of leaking data or returning a 500. Active/presence is
enforced upstream by the id and presence middlewares.

esign's signature operations (GetSignatureByID, AcceptSignature, RecordEvent)
now take a caller-provided scope instead of deriving one from the requested
ID, so signature reads and mutations are tenant-scoped at the source. This
removes the need for a resolver-level authorization helper; RecordEvent also
verifies signature ownership within scope before recording, since the event
foreign key is not tenant-composite.

Adds e2e non-regression tests covering owning vs. foreign trust center report
export and the generic node(id:) resolver.

Signed-off-by: Sacha Al Himdani <sacha@probo.com>

pkg/server/api/console/v1/trust_center_resolvers.go

@@ -922,7 +922,7 @@ func (r *trustCenterAccessResolver) NdaSignature(ctx context.Context, obj *types
 		return nil, nil
 	}
 
-	sig, err := r.esign.GetSignatureByID(ctx, *access.ElectronicSignatureID)
+	sig, err := r.esign.GetSignatureByID(ctx, scope, *access.ElectronicSignatureID)
 	if err != nil {
 		return nil, nil
 	}