Enforce IDOR level 1 profile ownership

[r1kka6]

Summary

• bind Level 1 profile reads to the user id from the validated token
• reject cross-user id requests before querying the profile table
• update unit coverage for denied cross-user access and allowed self access

Verification

• ./gradlew test spotlessJavaCheck bootJar --no-daemon passed in an eclipse-temurin:17-jdk container
• vulnerable baseline lets Alice read Bob with GET /IDORVulnerability/LEVEL_1?id=2
• patched runtime keeps Alice's own id=1 response working and rejects id=2 with Access Denied - Insufficient privileges