Verify signature ownership in esign accept/record-event flows

Any self-provisioned trust center visitor could accept another
visitor's NDA signature or inject audit-trail events into it by
supplying its GID, since AcceptSignature and RecordEvent trusted the
client-supplied signature ID without checking it belonged to the
caller (GHSA-22xj-f767-ppw6). SignerEmail/ActorEmail are always
derived from the verified session identity, never client input, so
comparing them against the signature's stored SignerEmail in
pkg/esign/service.go closes the hole at its root without touching the
resolver-level authorization already in place elsewhere.

Adds an e2e regression test that self-provisions two trust center
visitors through the real magic-link flow and confirms one cannot
touch the other's signature.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/esign/errors.go

@@ -18,4 +18,5 @@ import "errors"
 
 var (
 	ErrElectronicSignatureNotFound = errors.New("electronic signature not found")
+	ErrSignatureAccessDenied       = errors.New("signature does not belong to the caller")
 )

pkg/esign/service.go

@@ -19,6 +19,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strings"
 	"time"
 
 	"go.gearno.de/crypto/uuid"
@@ -327,6 +328,10 @@ func (s *Service) AcceptSignature(ctx context.Context, scope coredata.Scoper, re
 				return fmt.Errorf("cannot load electronic signature: %w", err)
 			}
 
+			if !strings.EqualFold(signature.SignerEmail, req.SignerEmail.String()) {
+				return ErrSignatureAccessDenied
+			}
+
 			if signature.Status != coredata.ElectronicSignatureStatusPending &&
 				signature.Status != coredata.ElectronicSignatureStatusFailed {
 				return fmt.Errorf("cannot accept electronic signature in status %s", signature.Status)
@@ -387,6 +392,10 @@ func (s *Service) RecordEvent(ctx context.Context, scope coredata.Scoper, req *R
 				return fmt.Errorf("cannot load electronic signature: %w", err)
 			}
 
+			if !strings.EqualFold(signature.SignerEmail, req.ActorEmail.String()) {
+				return ErrSignatureAccessDenied
+			}
+
 			return s.recordEvent(ctx, tx, scope, req)
 		},
 	)