OpenConstructionERP Files

Security-only release. Five-category deep audit (Planning, Communication, Procurement, Finance, Documents) found cross-tenant data-leak holes in every category. This release closes ~73 endpoints in a single batch.

Worst single hole

GET /api/v1/documents/photos/{id}/file/ and /thumb/ had zero authentication — no permission, no project access. Construction-site photos contain incidents, defects, badges, contracts pinned to walls. Now gated by documents.read + project ownership.

Categories patched

• Documents — photo serve + thumb (P0), sheets-by-id, documents_similar cross_project default flipped to false, all 11 CDE endpoints, 7 field-report endpoints
• Communication — export_meeting_pdf (zero-auth P0) + 4 meeting reads, full RBAC on transmittals (8 endpoints), submittals lifecycle + attachments (6), RFI respond/create_variation, ERP chat session creation
• Procurement — every PO endpoint (9) + list now requires project_id, change-order item/lifecycle (6 endpoints)
• Planning — every cost-model 5D endpoint (14), schedule activity/baseline/progress (14), tasks {task_id} (5), EAC _resolve_tenant_id no longer falls back silently to user_id

Bonus fix

approve_order now accepts an optional boq_id; _apply_to_boq returns a structured refusal when invalid, instead of silently writing to the first BOQ by created_at.

See [CHANGELOG.md](https://github.com/datadrivenconstruction/OpenConstructionERP/blob/v2.9.15/CHANGELOG.md#2915 for the full list.