fix: enforce ownership checks for attachments and correspondence

JobTrackerApi/Controllers/CorrespondenceController.cs

@@ -16,6 +16,15 @@ namespace JobTrackerApi.Controllers
             _db = db;
         }
 
+        // Resolve correspondence through its parent job so the DbContext's user-scoped
+        // job filter still protects raw id endpoints in multi-user deployments.
+        private Task<Correspondence?> FindOwnedMessageAsync(int correspondenceId, CancellationToken cancellationToken)
+        {
+            return _db.Correspondences
+                .Include(c => c.JobApplication)
+                .FirstOrDefaultAsync(c => c.Id == correspondenceId, cancellationToken);
+        }
+
         // GET all messages for a job
         [HttpGet("{jobId:int}")]
         public async Task<ActionResult<List<Correspondence>>> GetForJob([FromRoute] int jobId, CancellationToken cancellationToken)
@@ -72,7 +81,7 @@ namespace JobTrackerApi.Controllers
         [HttpDelete("{id:int}")]
         public async Task<IActionResult> Delete([FromRoute] int id, CancellationToken cancellationToken)
         {
-            var message = await _db.Correspondences.FirstOrDefaultAsync(c => c.Id == id, cancellationToken);
+            var message = await FindOwnedMessageAsync(id, cancellationToken);
             if (message is null) return NotFound();
 
             _db.Correspondences.Remove(message);