fix(cms): enforce access control in generateThumbnail local API calls

Pass overrideAccess:false to the payload.create('images') and
payload.update('articles') calls so the thumbnail endpoint enforces each
collection's access control instead of bypassing it with the default
overrideAccess:true. Both call paths guarantee an authenticated user
(REST returns 401 without one, MCP resolves it from the API key).

Author: claude

cms/src/endpoints/generateThumbnail.ts

@@ -334,6 +334,7 @@ export async function generateThumbnailCore(
       name: filename,
       size: buffer.length,
     },
+    overrideAccess: false,
     req,
   })
 
@@ -346,6 +347,7 @@ export async function generateThumbnailCore(
         data: { image: image.id },
         draft: articleStatus === 'draft',
         id: input.articleId,
+        overrideAccess: false,
         req,
       })
     } catch (error) {