fix(security): membership authz, tally bounds, public-state filtering, workflow default-deny, published-only ORI

[rubenvdlinde]

Summary

Fixes 7 security/correctness issues found in the quality-loop review.

• [HIGH] H1: castVote lacks meeting-membership authorization — any participant can vote on any open round #300 castVote now verifies the caller's resolved participant is a member of the meeting that owns the voting round before accepting a vote. Prevents any authenticated user from casting a vote on any open round.
• [HIGH] H3: saveShowOfHandsTally accepts unbounded chair-supplied vote counts — fabricated tally feeds ORI publication #302 saveShowOfHandsTally validates chair-submitted counts against the count of active participants in the meeting. Rejects tallies that exceed membership size.
• [HIGH] H4: ProjectionController::publicState leaks unpublished and secret voting round data to unauthenticated callers #303 getPublicState returns null (→ 404) for isSecret==true rounds and for rounds whose lifecycle is not 'published'. Anonymous projection callers can no longer see draft or secret ballot data.
• [MEDIUM] M2: WorkflowService::isTransitionAllowed chair-only check short-circuits allow-flags — latent bypass #313 WorkflowService::isTransitionAllowed evaluates domain allowPause/allowAdjourn flags before the chairOnlyTransitions list so domain restrictions cannot be short-circuited by a chair-only match.
• [MEDIUM] M3: getDomainWorkflow falls back to most-permissive 'operations' workflow on unknown domain #314 getDomainWorkflow falls back to a new RESTRICTED_WORKFLOW constant (quorum enforced, no pause, no adjourn) for unrecognized domains instead of the permissive operations config.
• [MEDIUM] M4: AgendaService::publishAgenda saveObject with partial Meeting payload may wipe required fields #315 AgendaService::publishAgenda and reviseAgenda now read the full meeting object before calling saveObject, preventing a partial-payload update from wiping required fields.
• [MEDIUM] M5: Public ORI endpoints return draft/unpublished objects — no publication filter on index/show #316 OriController::index filters to lifecycle=='published' via the OR query; ::show additionally checks the fetched object and returns 404 for non-published objects.
• [MEDIUM] M6: MotionService::transitionLifecycle has no caller/role authorization — callable from any DI path #317 MotionService::transitionLifecycle rejects an empty actorId to prevent unauthenticated DI-path callers from bypassing the controller's chair guard.

Test plan

• testPublishAgendaNotifiesOnlyActiveParticipants updated to stub the new find() call for the full meeting object
• PHP syntax clean on all 5 changed service/controller files
• Run composer test (unit suite — VotingServiceTest is skipped per issue Broken: 21 unit tests fail due to ObjectService stub/real-signature mismatch #90)
• Verify GET /api/ori/v1/events returns only published meetings
• Verify GET /api/ori/v1/voteevents/<draft-id> returns 404
• Verify anonymous publicState on a secret or non-published round returns 404
• Verify castVote with a participant not in the meeting returns 403
• Verify saveShowOfHandsTally with counts > participant count returns 400