EUVD-2026-8905

@actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget file access in multi-user mode...