fix(server): validate cross-org resource ownership

Review of the org-scoping pass found that org_id on a query filter
protects the row you look up, but does nothing when a handler accepts a
foreign resource ID as data and a downstream unscoped query consumes it.

- AssignKey: verify key and server both belong to the org
- BuildAuthorizedKeys: resolve server first, scope assignments and keys
  to that server's org (was honouring foreign assignment rows)
- Workflows: validate TargetServerIDs on create/update and re-check at
  trigger time
- Monitor incidents/uptime handlers: gate on org-scoped GetMonitor
- GetChannels: take orgID; validate channel_ids on monitor create/update
- Secret and default-step unique indexes: scope to org_id so a second
  org no longer hits E11000
- DeleteServer/DeleteMonitor: scope cascading deletes

server/internal/api/monitors.go

@@ -121,6 +121,15 @@ func deleteMonitor(c *gin.Context) {
 }
 
 func getMonitorIncidents(c *gin.Context) {
+	m, err := services.GetMonitor(auth.OrgID(c), c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if m == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "monitor not found"})
+		return
+	}
 	incidents, err := services.ListIncidents(c.Param("id"), 50)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
@@ -130,6 +139,15 @@ func getMonitorIncidents(c *gin.Context) {
 }
 
 func getMonitorUptime(c *gin.Context) {
+	m, err := services.GetMonitor(auth.OrgID(c), c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if m == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "monitor not found"})
+		return
+	}
 	since := time.Now().Add(-30 * 24 * time.Hour)
 	rollups, err := services.UptimeRollups(c.Param("id"), since)
 	if err != nil {