fix(cards): validate platformLink ownership before creating card links (#183)

POST /api/cards and PUT /api/cards/:id accepted arbitrary platformLink IDs
without verifying they belong to the authenticated user. Because platformLink
IDs are exposed in the public profile API, any authenticated user could attach
another user's verified social links to their own card, enabling impersonation.

Add a pre-flight ownership check before each CardLink write. A single indexed
query confirms every requested ID exists with userId = current user. If the
count does not match, the request is rejected with 403 before any write occurs.

Covered by new tests in src/__tests__/cards.test.ts.

Author: Ridanshi