Owner lookup runs before the permission gate, letting a caller enumerate entities they cannot access

On seven wired v2 actions the owner lookup executes before the RBAC gate. A caller with no permission therefore gets a different status depending on whether the id exists: 404 when it does not, 403 when it does. The status code alone reveals existence, so iterating ids yields a list of real ids the caller has no access to.

On two of them the 403 body goes further and names the owner's user UUID.

### Reproduction

Against a local manager in API mode as a plain user (not the owner, not an admin). The two ids differ only in whether the row exists; both are login sessions the caller does not own.

```bash
# existing session owned by another user
./bai my login-session revoke 36a574c6-...
-> 403 role_create_forbidden
msg: "User lacks permission on user "

# session id that does not exist
./bai my login-session revoke 00000000-0000-0000-0000-0000000000ff
-> 404 database_access_not-found
msg: "No field row matches the given id"
```

The 403 message discloses the owner's user UUID to a caller who was just denied access to that session. UUIDs above are local fixture accounts.

### Affected actions

Existence is distinguishable by status code on all seven. The last two also disclose the owner UUID in the 403 body.

- revoke_login_session — POST /v2/login-sessions/my/revoke
- delete_error_log — POST /logs/error/{log_id}/clear
- purge_entity_label — entity-label purge; an existing label gives 403, a missing one 404
- lookup_entity_label_owner — internal lookup reached through entity-label purge
- lookup_domain — gate is public; a missing domain 404s before any check, so domain names are enumerable
- lookup_error_log_owner — also returns the owner UUID in the 403 body
- lookup_login_session_owner — also returns the owner UUID in the 403 body

JIRA Issue: BA-7500

Start by reproducing the differing 403 and 404 responses in API mode for revoke_login_session, delete_error_log, purge_entity_label, lookup_domain, and the owner lookups listed in the issue. Trace where each owner or entity lookup runs relative to the RBAC gate. Done means unauthorized callers receive the same denial without entity existence or owner UUID disclosure across all seven affected actions.

Written by the indexing model from the issue text.