refactor: enforce customer resource ownership (OWASP API1 / BOLA)

[falberthen]

• CustomerOwnershipExtensions.EnsureCurrentCustomerOwns() - central guard that compares the token's CustomerId against the resource owner and returns ForbiddenError.
• OwnershipGuardRule + tests (for Quote and Order) - fail the build if a new handler accepts a customer-owned ID without injecting IUserInfoRequester.
• ForbiddenError + CustomControllerBase 403 - new error type mapped to HTTP 403 in the base controller.
• Quote handlers (Add/Cancel/Remove/Open/GetHistory) - inject IUserInfoRequester, call EnsureCurrentCustomerOwns before operating.
• Order handlers (Place/ConfirmDelivery/GetOrders/GetHistory) - same thing.
• Customer handlers (GetDetails/GetHistory/Update) - adopt a non-nullable GetCurrentUser() contract and CustomClaimTypes constant.
• OrderStatusHub - [Authorize(Roles=Customer)], JoinCustomerToGroup() takes no parameter (derives from claim).
• SignalrController - restricted to Roles.M2MAccess.
• JwtExtension.AddHubQueryStringAuthentication() - accepts access token via query string on WebSocket handshake.
• SPA SignalrService - sends token via accessTokenFactory, JoinCustomerToGroup() with no argument.
• .gitignore + tempkey.jwk deletion - dev RSA key never committed