Session timeout config

A signed-in user in one organization received a 403 for another organization’s invoice, but the response time and error body differ from a non-existent ID, which reveals whether an invoice exists.

GET /api/v2/invoices/inv_8f21c0
Host: staging.acme.dev
Authorization: Bearer ‹user B, org 2›

HTTP/1.1 403 Forbidden
{"error":"invoice belongs to another org"}

(non-existent ID → 404 "not found")

How to fix

Return the same 404 for “not yours” and “doesn’t exist”, and scope the lookup by organization in the query rather than checking ownership afterwards.