Approve/reject collaboration requests not scoped to route document or pending status

[Alimedhat000]

Problem

approveRequest / rejectRequest (server/src/controllers/document.controller.ts:713-716, :787) update requests by bare requestId from the body without verifying it belongs to req.params.id, and never check status === 'pending'. Nonexistent ids surface as Prisma 500s.

Impact

Requests can be approved/rejected through the wrong document route; already-decided requests can be re-decided.

Fix

Scope writes with updateMany({ where: { id: requestId, documentId: params.id, status: 'pending' } }) and treat zero matches as 404/409.

[Alimedhat000]

✅ Resolved by PR #85 (fix(server): scope collaboration request decisions to route document), merged to main via #87.

Covered by the Collaboration request decision scoping (#46) test suite in server/test/document.test.ts: cross-document approve/reject blocked (404), nonexistent requests 404, already-decided requests 409.