feat(api): scope pe cont la GET-urile de listare /v1/* (PRD 3.2)

Inchide scurgerea cross-account pe GET /v1/prezentari(/{id}),
/v1/mapari(/pending) si /v1/audit/export. Toate primesc
Depends(resolve_account_id) + account_scope_clause (regula NULL->cont 1,
OV-2). Nomenclatorul ramane global (referinta partajata, fara PII).

- B3: 404 cross-account byte-identic cu 404 inexistent (fara oracol enumerare)
- B4: get_prezentare cu allowlist de campuri (nu mai expune rar_creds_enc/
  payload_json/idempotency_key/rar_error)
- B1: pending_unmapped filtreaza in SQL; default None = global doar pentru web
- B2: helper account_scope_clause (DRY, doar pe submissions nullable)
- B5: index idx_submissions_account_status
- B8: regula de scope documentata in api-rar-contract.md
- TD-3.2: ?account_id != contul cheii -> 400

14 teste noi (cross-account, legacy NULL, B3, B4); suita 313 passed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/api-rar-contract.md

@@ -294,6 +294,19 @@ de 18 coduri la boot (`app/nomenclator_seed.py`) ca editorul sa mearga offline.
 Auth API-key (CORE) inca neimplementat -> `account_id` curge ca `NULL` si e atribuit
 contului default `id=1` (seed in schema); cand auth livreaza, account_id real curge natural.
 
+## Regula de scope pe cont (B8, PRD 3.2)
+
+Orice GET nou pe `/v1/*` care atinge `submissions` sau `operations_mapping` **PORNESTE**
+cu `account_id: int = Depends(resolve_account_id)` si clauza de scope pe cont in SQL.
+Varianta globala (fara scope) e exceptie justificata explicit — singurul exemplu actual
+este `GET /v1/nomenclator` (cache de referinta RAR fara PII, partajat intre conturi).
+
+Pentru `submissions` (account_id nullable): foloseste `account_scope_clause(account_id)`
+din `app/mapping.py` care produce `(account_id = ? OR (account_id IS NULL AND ? = 1))`.
+Randurile legacy cu `account_id IS NULL` apartin contului 1 (OV-2, back-compat).
+
+Pentru `operations_mapping` (account_id NOT NULL): `WHERE account_id = ?` simplu.
+
 ## Open questions rămase (actualizat)
 
 1. ~~Sursa pozei odometrului~~ — **închis** (poză opțională).