fix(api): restore atomic ownership check on activity comment writes

Re-add the userId predicate to the UPDATE/DELETE WHERE clauses in the
activity comment controllers so the write itself enforces ownership,
matching the comment controllers. The preceding SELECT was already
checking ownership, but the write was open on id alone — a TOCTOU gap.

Author: andrejsshell

apps/api/src/activity/controllers/delete-comment.ts

@@ -24,7 +24,7 @@ async function deleteComment(userId: string, id: string) {
 
   const [deletedComment] = await db
     .delete(activityTable)
-    .where(eq(activityTable.id, id))
+    .where(and(eq(activityTable.id, id), eq(activityTable.userId, userId)))
     .returning();
 
   if (!deletedComment) {

apps/api/src/activity/controllers/update-comment.ts

@@ -25,7 +25,7 @@ async function updateComment(userId: string, id: string, content: string) {
   const [updated] = await db
     .update(activityTable)
     .set({ content })
-    .where(eq(activityTable.id, id))
+    .where(and(eq(activityTable.id, id), eq(activityTable.userId, userId)))
     .returning();
 
   if (!updated) {