purchaseorderline: cross-tenant GET/PATCH/DELETE returns 403 — same class as #209 (secure-404)

[CryptoJones]

Problem

Same class as the seven prior secure-404 fixes (#173/#187/#191/#195/#199/#203/#209), now on the two-level cascade-scoped PurchaseOrderLine: polpoh → header.pohPovId → vendor.povCompId. Scoped callers can enumerate polId populations by status code.

Fix

Collapse both cases into 404. Cascade auth resolution preserved.

Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/