Fix security and quality issues from code review

Critical: Add company scoping to line item update/delete and note
delete via ownership verification through ticket join. Add companyId
validation to signed URL file serving. High: Paginate notes list
endpoint with search and sort support. Fix blob URL memory leaks in
AuthImage components with proper cleanup on unmount. Improve photo
upload error handling — count failures and show specific error count
instead of silently clearing form.

packages/backend/src/routes/v1/files.ts

@@ -143,6 +143,10 @@ export const fileRoutes: FastifyPluginAsync = async (app) => {
       if (payload.purpose !== 'file-access' || payload.path !== filePath) {
         return reply.status(403).send({ error: { message: 'Invalid token', statusCode: 403 } })
       }
+      // Validate company isolation — file path must start with the token's companyId
+      if (payload.companyId && !filePath.startsWith(payload.companyId)) {
+        return reply.status(403).send({ error: { message: 'Access denied', statusCode: 403 } })
+      }
     } catch {
       return reply.status(403).send({ error: { message: 'Token expired or invalid', statusCode: 403 } })
     }