fix(workflows): validate template ownership

[vladbisceanu]

Workflow step mutations currently accept any existing templateId, including templates owned by another project. The relation is then exposed by workflow reads, crossing Plunk’s project boundary.

This adds one project-scoped validator and applies it before all three step mutation paths that accept template IDs: add, update, and insert-on-transition. Foreign and nonexistent IDs deliberately return the same 404 response. Null and omitted IDs keep their existing behavior.

Verification:

• yarn test:run apps/api/src/services/__tests__/WorkflowService.test.ts --maxWorkers=1 (69 tests)
• focused ESLint
• yarn build --filter=api
• code review and security-only review found no actionable issues

[vladbisceanu]

@driaug I opened several fixes while hardening a downstream Plunk deployment. To keep review manageable, the independent ones I would prioritise are #463, #464, #465 and #472. I moved the feature and stacked work back to draft, fixed the wrong base branches, and updated #462 to current next. Before I do more on the stack, are these fixes in line with where you want next to go?