sec(api): bound update-any by its Constraints on planned-purchase run #1129

Summary

The planned-purchase run (execute-now) route lets an update-any holder act on another user's execution without checking update-any's Constraints. This is the same class of gap as #1098 (pause/resume) and #961 (DELETE). The execute permission's own Constraints still apply to the row's recommendations, so the impact is narrower.

Evidence (origin/main d9b2aa7)

• The run handler (internal/api/handler_purchases.go, :386) authorizes through authorizeExecutionManagement (:183-189). For a principal that is not the creator, this only checks that update-any is held, not its Constraints.
• Execute Constraints are checked afterwards against the recommendations (~:405).
• The pause/resume fix for sec(api): planned-purchase pause/resume ignore the update-any permission's Constraints #1098 adds a constraint-aware helper. fix(api): bound update-any by its Constraints on planned-purchase DELETE #1097 (draft) adds authorizePlannedFullScope for DELETE.

Scenario

A user holds update-any limited to provider=aws and an unconstrained execute. They can run another user's Azure planned purchase. The update-any bound is meant to stop them acting on rows outside their scope.

Proposed fix

Apply the same update-any Constraints check that #1098 and #1097 use to the run route. Once both land, consolidate on one helper. Add tests: bounded update-any is denied out of scope and allowed in scope; the creator is unaffected; admin is unaffected; a constraint-store error is not treated as a denial.

Found during review of the #1098 fix.