Add explicit CompanyId to tenant-scoped FindAsync queries (partial sweep)

Multi-tenant defense-in-depth sweep, FindAsync/FirstOrDefaultAsync vector.
Adds explicit CompanyId predicates to list/index/validation queries that
previously relied only on the global tenant filter (exposure: raw
platform-admin sessions where the filter is bypassed).

Done this pass:
- Financial: Budgets, CreditMemos, FixedAssets, GiftCertificates,
  TaxRates, PricingTiers, VendorCredits, Accounts (year-end close),
  Invoices (tax-rate default, merchandise).
- Operational: Inventory (bin/sample-panels/vendors/usage-edit),
  OvenScheduler (ovens/batches/queue), Customers (pricing tiers),
  InAppNotifications (mark-all-read), CatalogItems (by-category /
  merchandise / price-check lists).
- AI: AiQuickQuote and Quotes (powder cost, predictions, walk-in
  customer, benchmark), Reports (budgets, 1099 vendors).

Child-by-parent-FK and by-PK queries were left as-is (already scoped via
the verified parent). Builds clean; 293 unit tests pass.

REMAINING (next session): ReportsController.Analytics powder-usage query
(line ~593) and the ~20 CompanySettings delete-protection Count/Any +
dup-code checks.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/PowderCoating.Web/Controllers/ReportsController.cs

@@ -2512,7 +2512,7 @@ public class ReportsController : Controller
         var reportYear = year ?? DateTime.Now.Year;
 
         // Load all budgets for the year for the selector
-        var allBudgets = (await _unitOfWork.Budgets.FindAsync(b => b.FiscalYear == reportYear))
+        var allBudgets = (await _unitOfWork.Budgets.FindAsync(b => b.CompanyId == companyId && b.FiscalYear == reportYear))
             .OrderBy(b => b.Name).ToList();
 
         Core.Entities.Budget? budget = null;
@@ -2520,10 +2520,10 @@ public class ReportsController : Controller
             budget = await _unitOfWork.Budgets.GetByIdAsync(budgetId.Value, false, b => b.Lines);
 
         budget ??= (await _unitOfWork.Budgets.FindAsync(
-            b => b.FiscalYear == reportYear && b.IsDefault, false, b => b.Lines)).FirstOrDefault();
+            b => b.CompanyId == companyId && b.FiscalYear == reportYear && b.IsDefault, false, b => b.Lines)).FirstOrDefault();
 
         budget ??= (await _unitOfWork.Budgets.FindAsync(
-            b => b.FiscalYear == reportYear, false, b => b.Lines)).FirstOrDefault();
+            b => b.CompanyId == companyId && b.FiscalYear == reportYear, false, b => b.Lines)).FirstOrDefault();
 
         ViewBag.ReportYear    = reportYear;
         ViewBag.Budget        = budget;
@@ -2599,7 +2599,7 @@ public class ReportsController : Controller
         var periodEnd   = new DateTime(reportYear, 12, 31, 23, 59, 59, DateTimeKind.Utc);
 
         // Load 1099-eligible vendors
-        var vendors = (await _unitOfWork.Vendors.FindAsync(v => v.Is1099Vendor)).ToList();
+        var vendors = (await _unitOfWork.Vendors.FindAsync(v => v.CompanyId == companyId && v.Is1099Vendor)).ToList();
 
         var rows = new List<Vendor1099Row>();