Fix scoped access checks

__tests__/api/security.test.ts

@@ -57,10 +57,16 @@ describe('Security: cross-user access', () => {
 
       expect(response.status).toBe(200)
       expect(data).toHaveLength(1)
-      // Verify the query filtered by user_id
+      // Verify the query includes owned products and products shared through membership.
       expect(mockPrisma.product.findMany).toHaveBeenCalledWith(
         expect.objectContaining({
-          where: expect.objectContaining({ user_id: 'user-1' }),
+          where: expect.objectContaining({
+            archived: false,
+            OR: expect.arrayContaining([
+              { user_id: 'user-1' },
+              { members: { some: { user_id: 'user-1' } } },
+            ]),
+          }),
         })
       )
     })