[MugdhoAI]

Summary

• Extend the PostgreSQL-backed secret lifecycle test to verify that another user cannot list, retrieve, update, or delete an owner's secret.
• Verify denied update/delete attempts leave the owner's secret unchanged.

Why

Owner-scoped authorization is a core security property of this API. The implementation already filters each operation by owner_id, but the integration test previously verified cross-user access only for retrieval.

Verification

• GitHub Actions will run the PostgreSQL-backed tests, Ruff, dependency audit, Docker and Compose validation across Python 3.12–3.14, plus CodeQL.