fix: enforce quiz ownership on submit and grade

[krishhimself]

The bug

PR #6 established who the caller is. It never checked that the quiz was theirs.

Any logged-in user who knew or guessed a quiz_id could answer and grade somebody
else's attempt. That makes the attribution the token establishes worthless — a
comprehension score is a claim about a specific person, and this let one person's
answers land on another person's record.

The fix

Ownership is a precondition of loading the attempt, not a check each caller performs:

async def _load_owned_attempt(quiz_id: str, user_id: str) -> dict:
    attempt = await quiz_repository.get_attempt(quiz_id)
    if not attempt or attempt.get("user_id") != user_id:
        raise LookupError("quiz_not_found")
    return attempt

start_followup and grade_quiz both go through it, and user_id is a required
argument on both. When the signatures changed, five existing tests failed with
TypeError rather than quietly passing — which is the point. An endpoint that forgets
to pass the caller cannot compile by accident into a bypass.

Live verification

Two real accounts against Atlas:

A generates quiz      -> 200  quiz_id: d3bfe40f
B submits to A quiz   -> 404  "Quiz not found"    <- blocked
B grades A quiz       -> 404  "Quiz not found"
B submits fake id     -> 404  "Quiz not found"    <- identical
A submits own quiz    -> 200  follow-up issued

Three decisions worth reviewing

404, not 403. A 403 would confirm the quiz exists, turning the endpoint into an
oracle for discovering valid ids. Tests assert the missing-quiz and foreign-quiz
responses are byte-identical — the same reasoning already applied to login not
revealing whether an account exists.

Refusal happens before any model call. Two tests assert
generate_followup_question and grade_answers are never reached on a rejected
request, so an attacker cannot burn the daily Gemini quota (20/day/model) on quizzes
they have no access to.

Unowned attempts are unreachable by everyone. Any attempt created before auth
existed has user_id: None and now 404s for every caller. That is correct rather than
unfortunate — an unattributed attempt proves nothing about anyone — but it does mean
such rows are dead. There are none in the current database.

Verification

102 tests pass (92 backend, 10 frontend). 9 new tests covering ownership at both the
service and HTTP boundaries.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PET9qKZXhgjEbZK7MReYQj