Rack/miner management RPCs enforce org-scoped RBAC only (no site-scoped check)

### Summary

Rack and miner management RPCs authorize at **org scope** (`authz.ResourceContext{}`) rather than checking the caller's access to the specific miner/site. A user with site-scoped `miner:read` / `rack:manage` for only some sites can therefore act on miners in sites they don't have access to.

Surfaced by @flesher in review of #654 (QR-scan rack assignment):

> With an empty resource context this lookup is only org scoped. A user could technically scan a miner from a site they don't have access to and assign it another rack.

### Scope (not specific to the QR-scan feature)

The QR-scan `LookupMinerByIdentifier` is consistent with the existing posture — the whole rack/miner-management surface is org-scoped today:

- `LookupMinerByIdentifier` — `ResourceContext{}`
- `SaveRack` (the actual assignment) — `ResourceContext{}`
- `CreateDeviceSet` / `UpdateDeviceSet` — `ResourceContext{}`
- Miner read/rename/delete/update-worker-name handlers — `ResourceContext{}` (11 org-scoped calls in `fleetmanagement/handler.go`)

Only `requireRefreshMinerRead` scopes per-resource. So closing the reported gap means introducing site-scoped enforcement across the assignment path (at minimum the lookup **and** `SaveRack`), not just one endpoint — otherwise the same cross-site assignment stays reachable via the list/search flow.

### Suggested direction

- Decide whether rack/miner management should enforce site-scoped RBAC (the model already supports it: `authz.ResourceContext{SiteID}` + org→site narrowing semantics).
- If yes: resolve the target miner's site, then `RequirePermission(..., ResourceContext{SiteID})`; apply consistently across the read + assignment endpoints.
- Likely overlaps with #428 (reusable building/site scope + scoped RBAC).

### Context

- Raised on #654 (merged as-is; QR lookup matches current org-scoped posture, doesn't widen the gap).
- Related: #428.

Start in fleetmanagement/handler.go and trace LookupMinerByIdentifier, SaveRack, and the listed rack/miner management handlers using authz.ResourceContext{}. Decide whether site-scoped RBAC is required, then follow the assignment path from lookup through SaveRack. Done means the relevant read and assignment endpoints resolve the miner site and consistently enforce the caller's site-scoped permission.

Written by the indexing model from the issue text.