Enforce per-user data scoping

Audit all queries and add user scoping so that each user only sees and modifies their own companies, applications, contacts, notes, tasks, and tags. Add tests that verify cross user access is denied.

Audit all database queries across models like companies, applications, contacts, notes, tasks, and tags to ensure they include user_id scoping. Start by examining the data access layer or repository pattern files. Write tests that simulate cross-user access attempts to verify denial. Look for existing authentication middleware to understand how user context is passed.

Escrita pelo modelo de indexação a partir do texto da issue.