fix(security): enforce team-scoped project/env lookups in onboarding

Use firstOrFail() for team-scoped project and environment lookups across
new-project Livewire flows so missing or cross-team UUIDs fail closed.
Also dispatch an error when boarding selects a non-owned project, and
update IDOR feature tests for the new error/exception behavior.

app/Livewire/Boarding/Index.php

@@ -432,6 +432,9 @@ class Index extends Component
     public function selectExistingProject()
     {
         $this->createdProject = Project::ownedByCurrentTeam()->find($this->selectedProject);
+        if (! $this->createdProject) {
+            return $this->dispatch('error', 'Project not found.');
+        }
         $this->currentState = 'create-resource';
     }