Classify token-only route ownership controls #874

Source of truth

Follow-up from #782. The first-pass security route inventory shows many authorized handlers are token-only at the route layer and rely on module-level ownership or group permission checks.

Scope

• Classify each token-only route in docs/security-route-inventory.md as user-owned object access, group membership, group edit/admin, admin/core permission, safe self route, or ambiguous/missing control.
• Start with group, groupCategory, content, fileCatalog, staticSiteGenerator, pin, autoActions, and social import modules.
• Convert ambiguous or missing checks into focused tests and fixes.
• Update docs/security-review.md and regenerate docs/security-route-inventory.md when route/security notes change.

Verification

• npm run security:route-inventory
• Targeted tests for any ownership fixes added.