fix(iam): close authorization gaps in core controllers

[roncodes]

Summary

An authorization audit found several core endpoints that skip permission checks or resolve to permission names that don't exist, so AuthorizationGuard let every user through.

Area	Before	After
Organization update (PUT companies/{id})	Any member could update the organization, including owner_uuid (verified locally: a dispatcher made themselves owner), Stripe ids, plan and status	Requires the owner, the Administrator role or a system admin. owner_uuid, Stripe ids, plan, status, trial_ends_at and type are ignored for non-admin updates; ownership still moves through the transfer endpoint
Organization 2FA policy	Any member could disable enforcement	Owner, Administrator role or system admin
System 2FA policy (POST two-fa/config)	Any signed-in user could change it for every organization	System admins only (reading it stays open; the account and settings pages use it)
Admin platform metrics	Any user could read platform-wide figures	System admins only
IAM and developer metrics	Unchecked	iam list user / developers list api-key
Reports	ReportController resolved to the fleetbase service, so no permission matched and every report endpoint was open	iam service. Direct query execution requires iam execute report; export and download require iam export report
API credentials, webhooks, API events, request logs	Resolved to api-credential, webhook-endpoint, … which no permission uses, so they were unguarded (any user could list and create API keys)	Controllers declare $permissionResource (api-key, webhook, event, log), matching the Developers schema and the dev console

How

• HasApiControllerBehavior::getPermissionResourceName() and Auth::getPermissionResourceFromController() let a controller name the schema resource its permissions use. They default to the model's singular name, so nothing else changes.
• Auth::cannotUnlessAdmin() supports explicit checks outside the guard.
• The new checks are registered as controller middleware scoped with ->only(), so behaviour through the router changes and existing unit tests that call methods directly still exercise the endpoint logic.

Behaviour changes to note

• Users need iam … report permissions to use reports. The Fleet-Ops reports screens now check the same names ((fix(permissions): enforce Fleet-Ops permissions across the API and console fleetops#345)).
• Organization settings are limited to the owner, the Administrator role and system admins.

Test plan

• New tests: permission resource alias resolution; cannotUnlessAdmin; organization-manager middleware (member refused; owner, Administrator role and system admin allowed); owner_uuid/status ignored on update; 2FA and report middleware registration and refusal.
• tests/Unit: 1831 passed. One failure, UtilsTest › utils reads composer package keywords, also fails on main locally.
• Staging: an org member without the Administrator role gets 401 on PUT companies/{id}; a dispatcher gets 401 on GET api-credentials.