Restrict profile pages to their owner and check organization permissions before saving

[jh-RLI]

Summary of the discussion

Pages under profile/<user_id>/ are a user's own dashboard. There is no public profile, but the views did not check that the id in the address was the caller's own, so they relied on template conditions instead. This PR adds that check in one place and applies it to every profile route. It also adds the missing permission checks to the organization views.

Profile routes (owner rule). login/access.py holds the rule as a mixin (ProfileOwnerRequiredMixin) and a decorator (profile_owner_required). Every route whose address carries a user_id uses one of them (17 routes):

caller	full page	htmx request
owner	served	served
logged in, another id	404	404
anonymous	302 to login, with next	401, empty body

• The answer to another id is 404 rather than 403, and it is the same whether or not that id belongs to an account.
• Platform admins are not exempt.
• When the id matches, the view uses request.user and does not load the user named in the address.
• An htmx request gets 401 instead of the login redirect. htmx would follow the redirect and swap the login page into the fragment.
• The dataset routes run the existing creator check (403) after the owner rule.
• The edit view's hand-written check is replaced by the rule.
• The delete_acc route now answers 404 instead of raising, because handler404 did not accept user_id.
• A structural test walks every URL pattern from the site root, including parameters captured by include() prefixes, and fails for any user_id route on which the rule does not actually run. enforces_owner_rule checks what runs: a class view must resolve dispatch to the mixin's own, so a mixin listed after View or a dispatch override is rejected. A function view must be the decorator's own wrapper as the outermost layer, and a function that merely copies its attributes is rejected. A decorator around a class view's as_view() is rejected too, because functools.wraps copies view_class onto it while the decorator runs first. Self-tests pin each rejected case.

Organization views.

• OrganizationManagementView and OrganizationMembersView now list LoginRequiredMixin before the view class. View.dispatch never calls further along the MRO, so the mixin was not running before.
• Editing an organization checks the caller's membership before the form is saved. A non-member gets 404, a member below admin gets 403, and nothing is written.
• Creating an organization saves the organization and its first admin in one transaction.
• The member list is shown to members only.
• A member is removed only when none of the checks refused the removal. The check against a higher level now runs before the last-admin check, not after it.
• The redirects after create, leave and delete are built with reverse instead of a written-out path.
• The organization and membership lookup with a minimum level is one helper, membership_or_404 in login/access.py. It answers 404 for a non-member and 403 for a level that is too low, as before.
• The refusal codes are the ones these views already used: no membership 404, too low a level 403, no login 302.

Tests changed, and why.

• In login/tests/test_dataset_views.py, two tests asserted the old answers on another user's dashboard (403 on create, 200 on the page). They now expect 404.
• Four "non-creator" tests reached the creator check through another user's dashboard id. They now use the caller's own id, so they still test the creator check (403).
• In login/tests/test_views.py, the smoke GETs of profile routes now log in, so they still render the pages instead of only following the login redirect.

New tests:

• login/tests/test_profile_owner_rule.py (structural test, owner/foreign/anonymous × page/htmx on every route, unknown ids, POST routes, a content check on the tables list, and refused GETs that write nothing)
• login/tests/test_organization_write_checks.py (includes the create, leave and delete redirects to the caller's own organizations page)
• shared helpers in login/tests/helpers.py

Full suite: 963 tests OK (105 skipped, the Fuseki-dependent OEKG tests). The OpenAPI drift guard is unchanged and passes.

Not in this PR:

• The settings page still ensures an API token for every user on each visit. Only the owner reaches it now.
• Anonymous htmx requests to the organization views still get the login redirect rather than a 401.

Type of change (CHANGELOG.md)

Bugs

• Restrict profile pages to their owner and check organization permissions
  before saving
  (#2547)

Workflow checklist

Automation

Closes #2538

PR-Assignee

• 🐙 Follow the workflow in
  CONTRIBUTING.md
• 📝 Update the
  CHANGELOG.md
• 📙 Update the documentation on
  mkdocs

Reviewer

• 🐙 Follow the
  Reviewer Guidelines
• 🐙 Provided feedback and show sufficient appreciation for the work done

🤖 Generated with Claude Code