#2836 refactor: clean up router validation

Summary

• consolidate org-scoped router validation helpers
• apply the shared validation path across related routers
• add regression coverage for the touched routes

Testing

• bun test packages/trpc/src/router/task/task.test.ts
• bunx biome check packages/trpc/src/router/utils/active-organization.ts packages/trpc/src/router/utils/org-resource-access.ts packages/trpc/src/router/task/task.ts packages/trpc/src/router/task/task.test.ts packages/trpc/src/router/project/project.ts packages/trpc/src/router/workspace/workspace.ts packages/trpc/src/router/project/secrets/secrets.ts packages/trpc/src/router/v2-project/v2-project.ts packages/trpc/src/router/v2-workspace/v2-workspace.ts
• bunx tsc -p packages/trpc/tsconfig.json --noEmit

---

Summary by cubic

Centralized org-scoped validation with shared helpers and enforced them across routers. Task reads are now protected and scoped to the active org; all write paths validate related resources belong to the same org and return clear errors.

• Refactors

  • Added requireActiveOrgId, requireActiveOrgMembership, requireOrgScopedResource, requireOrgResourceAccess; replaced ad‑hoc checks in project, v2-project, workspace, v2-workspace, secrets, and task.
  • Converted task reads (all, byOrganization, byId, bySlug) to protected routes using the active org; validate statusId, assigneeId, githubRepositoryId, projectId, and deviceId before writes; reject empty update payloads; normalize deletes to org membership + resource scoping.
  • Removed outdated organization auth tests; added focused task auth/scoping tests; isolated session org state tests in @superset/auth; trimmed unstable desktop workspace tests.

• Bug Fixes

  • Enforced membership on task reads and before updates/deletes; filter all by the active org; prevent updates/deletes on already-deleted tasks.
  • Blocked cross-org changes with clear 400/404 errors for related IDs and ensured internal assignment clears external assignee snapshots.

Summary by CodeRabbit

• Bug Fixes

  • Unified and tightened organization-scoped authorization across projects, workspaces, tasks, secrets, and repository linking to block cross-organization access; create/update/delete now validate and operate on resolved scoped resources and enforce non-deleted constraints.
  • Several flows now require membership checks instead of broader admin checks and return clearer bad-request/forbidden errors when scoped resources are missing or mismatched.

• Tests

  • Added comprehensive org-scoping and tenant-isolation tests for task behaviors; removed an outdated organization authorization test suite.

• Chores

  • Deferred database initialization to a lazy cached loader to improve startup behavior.