[DT-4061] Gate study PATCH on ownership of the study

[otchet-broad]

Base: branch 1 · 3 files, +41/-3 · Migration: no · UI impact: yes — the one to scrutinize

Requires creator/custodian/admin ownership for PATCH /api/dataset/study/{studyId}, matching what the registration PUT path
already enforces. The @RolesAllowed gate on the endpoint only says the
caller holds a study-editing role somewhere in DUOS, and a publicly visible
study passes the read-visibility check for everyone, so read visibility
cannot stand in for write authorization.

This is a behavior tightening: a chairperson or data submitter who is not
the study's creator or custodian now receives 403 where a PATCH of a
publicly visible study previously succeeded. Worth confirming against how
the UI gates the study edit form before merging.

Deliberately a sibling of branch 1 rather than a link in the chain. Nothing
else in DT-4061 depends on it, so it can be held for a longer discussion,
revised, or dropped without blocking the other seven PRs. Small enough to
review in one sitting: the resource hunk, one new test, and the OpenAPI 403
documentation.

Depends on: branch 1 (shares the StudyResource PATCH method).

---

Where this sits in the DT-4061 stack

otchet-dt-3990-study-ratings-pi-details was too large to review meaningfully
(95 files, +8168), so it was split into eight PRs. This PR targets otchet-dt-4061-study-visibility-authz,
not develop, so its diff shows only its own work.

#	Branch	Base
1	otchet-dt-4061-study-visibility-authz	develop
1b	otchet-dt-4061-study-patch-ownership ← this PR	otchet-dt-4061-study-visibility-authz
2	otchet-dt-4061-study-pi-details	otchet-dt-4061-study-visibility-authz
3	otchet-dt-4061-study-comments	otchet-dt-4061-study-pi-details
4	otchet-dt-4061-study-dar-metrics	otchet-dt-4061-study-comments
5	otchet-dt-4061-study-recommendations	otchet-dt-4061-study-dar-metrics
6	otchet-dt-4061-study-asset-fields	otchet-dt-4061-study-recommendations
7	otchet-dt-4061-study-asset-endpoints	otchet-dt-4061-study-asset-fields

Branch 1b is a sibling rather than a link in the chain: nothing depends on it,
so it can be held or dropped without blocking the others. Land the numbered
chain in order — merging out of order, or squash-merging, will require rebasing
the descendants.

The split is verified lossless: branch 7 plus 1b reproduces the original branch
exactly, apart from five scripts/verify-study-*.sh helper scripts that were
dropped at the author's request. ./mvnw test-compile passes on each branch
independently.

🤖 Generated with Claude Code