feat: Add creator info, team management for companies, and member access control

- Add creator info (username) to companies, projects, and notes responses
- Add company_users table for team management on companies
- Add resourceAccessMiddleware for member access control
- Members can only see resources they are directly assigned to
- Companies, projects, and todos are now filtered by user assignments
- Add personal contacts feature

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/routes/todo.routes.js

@@ -1,6 +1,8 @@
 import express from 'express';
 import * as todoController from '../controllers/todo.controller.js';
 import { authenticate } from '../middlewares/auth/authMiddleware.js';
+import { requireAdmin } from '../middlewares/auth/roleMiddleware.js';
+import { checkTodoAccess } from '../middlewares/auth/resourceAccessMiddleware.js';
 import { validateBody, validateParams } from '../middlewares/security/validateInput.js';
 import { createTodoSchema, updateTodoSchema } from '../validators/crm.validators.js';
 import { z } from 'zod';
@@ -21,27 +23,31 @@ router.get('/', todoController.getAllTodos);
 router.get(
   '/:todoId',
   validateParams(z.object({ todoId: z.string().uuid() })),
+  checkTodoAccess,
   todoController.getTodoById
 );
 
-// Create new todo
+// Create new todo (admin only)
 router.post(
   '/',
+  requireAdmin,
   validateBody(createTodoSchema),
   todoController.createTodo
 );
 
-// Update todo
+// Update todo (admin only)
 router.patch(
   '/:todoId',
+  requireAdmin,
   validateParams(z.object({ todoId: z.string().uuid() })),
   validateBody(updateTodoSchema),
   todoController.updateTodo
 );
 
-// Delete todo
+// Delete todo (admin only)
 router.delete(
   '/:todoId',
+  requireAdmin,
   validateParams(z.object({ todoId: z.string().uuid() })),
   todoController.deleteTodo
 );
@@ -50,6 +56,7 @@ router.delete(
 router.patch(
   '/:todoId/toggle',
   validateParams(z.object({ todoId: z.string().uuid() })),
+  checkTodoAccess,
   todoController.toggleTodo
 );