Summary
- add externalId-scoped chat, messages, conversations, and stream endpoints that return "Not found" on mismatches
- centralize ownership checks in a shared access helper and reuse it across scoped APIs
- add tests and docs to make the safe path explicit
Testing
- not run here (user reported tests passing locally)