The categorization, bulk rule re-evaluation, and automation-rule apply
status endpoints looked jobs up by a bare job UUID. Any authenticated
user who obtained another user's job id could poll its progress payload.
Include the owning user's id in the cache key so a status request keyed
by the polling user's id can only resolve that user's own jobs; a
mismatched owner now falls through to the existing 404. No ownership
store or extra lookup needed. Added cross-user isolation tests for all
three endpoints.
93e2d6823c