fix(security): prevent session ID enumeration via 404 response (#3071)

PR #3146 — approved by aegis-gh-agent[bot] (Argus)

Cross-tenant session access returns 404 instead of 403 to prevent session ID enumeration.

Author: OneStepAt4time

src/routes/context.ts

@@ -259,7 +259,8 @@ export function requireSessionOwnership(
   if (callerTenantId && callerTenantId !== SYSTEM_TENANT && session.tenantId !== callerTenantId) {
     const audit = getAuditLogger();
     if (audit) void audit.log(resolveRequestAuditActor(auth, req, 'api-key'), 'session.action.denied', `Cross-tenant ${actionLabel} denied on session ${sessionId} (tenant: ${session.tenantId})`, sessionId, callerTenantId);
-    reply.status(403).send({ error: 'SESSION_FORBIDDEN', message: 'Session belongs to another tenant' });
+    // Issue #3071: Return 404 instead of 403 to prevent session ID enumeration
+    reply.status(404).send({ error: 'Session not found' });
     return null;
   }