fix(tests): update 403 to 404 for cross-tenant session access (#3360)

#3360 changed cross-tenant session access from 403 to 404 to avoid
tenant enumeration. Two tests still asserted 403.

Author: OneStepAt4time

src/__tests__/dashboard-session-auth.test.ts

@@ -200,7 +200,7 @@ describe('dashboard session cookie request auth', () => {
       url: '/v1/owned/other-tenant',
       headers: { cookie: cookieHeader(dashboardSession.sessionId) },
     });
-    expect(otherTenant.statusCode).toBe(403);
+    expect(otherTenant.statusCode).toBe(404);
   });
 
   it('filters global SSE events for tenant-scoped dashboard sessions', () => {

src/__tests__/multitenancy-1944.test.ts

@@ -400,7 +400,7 @@ describe('Multi-tenancy (#1944) — requireOwnership with tenant', () => {
     const result = requireOwnership(sessions, 's-1', reply, 'globex-key', 'globex');
 
     expect(result).toBeNull();
-    expect(reply.status).toHaveBeenCalledWith(403);
+    expect(reply.status).toHaveBeenCalledWith(404);
   });
 
   it('allows same-tenant access', async () => {