docs : expand owner-scoping guidance in API authentication docs

[tmdeveloper007]

Summary of What Needs to be Done:
The API authentication docs (docs/api-authentication.md) describe how to authenticate with the API key but do not explain how multi-workspace isolation works via the X-User-Id header.

Changes that Need to be Made:
Add an "Owner Scoping and Multi-Workspace Isolation" section to docs/api-authentication.md covering:

• The X-User-Id header and how it drives owner_id on tasks/findings/reports
• The difference between the shared deployment API key (authentication) and the per-user owner identity (authorization)
• How resolve_owner_id() maps X-User-Id to user: format
• The DEFAULT_OWNER_ID fallback for single-user deployments
• Example: passing X-User-Id: alice to isolate Alices workspace data
• Security note: upstream auth proxy is responsible for validating X-User-Id before forwarding

Impact that it would Provide:

• Helps operators understand how workspace isolation works in shared deployments
• Reduces support questions about data visibility across users
• Documents the BOLA protection introduced by issue Task and report APIs lack a user/owner authorization model #401

Note: This task is being handled by tmdeveloper007 — please assign to that account when picking it up.