IDOR via predictable IDs: a logic bug dressed as auth

When UUIDs in the URL aren't secret — and the API never checks ownership.