feat(roles): let each section decide who may assign work to others

Section access now only creates a record for yourself. Assigning it to a colleague requires a separate permission on that section.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/common/record-scope.ts

@@ -225,8 +225,10 @@ export function noteAccessWhere(
 export function resolveOwnerId(
   actor: Pick<Actor, 'userId' | 'role'>,
   requested?: string | null,
+  allowOthers?: boolean,
 ): string {
-  if (elevated(actor.role) && requested?.trim()) {
+  const allowed = allowOthers ?? elevated(actor.role);
+  if (allowed && requested?.trim()) {
     return requested.trim();
   }
   return actor.userId;