Requester and inbox access hardening: anonymous initiator, guarded outcomes, return target

The pre-alpha12 audit found no exploitable defect in the requester-facing and tenant-isolation surfaces, but three hardening gaps are worth closing before the alpha. None is remotely exploitable in the shipped configuration today; each removes a latent hazard or an inconsistency.

S1: anonymous uid-0 initiator collision. ProcessInstance::getInitiatorId() returns a stored 0 as 0, and ownership is computed as initiator equals the current user id. For an anonymous account the id is 0, so an instance whose initiator is 0 would be owned by every anonymous visitor. The guard tests for not-null, which does not catch 0. This is latent because no shipped start path stores 0 (the webform handler maps an anonymous owner to null and the server API passes no initiator) and the requester permission is not granted to anonymous by default, but it is inconsistent with OperationAccessCheck, which denies anonymous outright. Fix: normalize 0 to null at the source (getter and setter) and deny anonymous explicitly in the initiator access check and the my-instances list.

S2: inbox complete() does not enforce guarded (requires-UI) outcomes. The one-click inbox links deliberately withhold guarded outcomes, and the operation-signal controller refuses a guarded outcome inline, but InboxController::complete() passes its result query parameter straight through with no guarded-outcome check, so a hand-crafted URL can skip the mandatory-input step. Authorization is intact, so this is a workflow-integrity gap, not a privilege escalation. Fix: re-check the guarded outcomes in complete() and redirect to the task form, matching the operation-signal controller.

I2: operator return target dropped on a guarded inline signal. When an operator triggers a guarded outcome inline from a list, the task and operation controllers redirect to the step surface without preserving the orchestra_return target, so after completing they land on the default list instead of where they came from. UX only. Fix: carry the request return target into the guarded redirect.

Fixing all three in one merge request, with an access-matrix kernel test covering the requester detail view across own/other-user/other-tenant/anonymous and null-initiator cases, and French translations for any new strings.