LiveView event handlers were trusting client-supplied record IDs without
verifying they belong to the user's current map/user scope. A logged-in
user could push another map's record UUID over the LV socket and act on
it. Affected handlers:
- cancel-subscription / edit-subscription / update_subscription
(cancel or upgrade any map's paid subscription by ID)
- characters_live.ex "delete"
(soft-delete any user's character and null their user_id)
- cancel_ping
(cross-map rally-ping cancellation broadcast)
- deleteSystemComment
(cross-map comment deletion)
- update_passage_mass
(cross-map wormhole passage mass corruption)
- updateCharacterTracking
(untrack another user's character on a shared map)
Also fixes a related numeric-trust bug in subscribe/update_subscription
where `period`, `characters_limit`, and `hubs_limit` were parsed without
bounds, allowing `period: "-1"` to produce a back-dated subscription
with a negative price.
Adds WandererAppWeb.HandlerAuth with focused helpers each handler now
routes through, plus 26 regression tests covering both the IDOR auth
checks and the bounded-int parsers.
