Prepare ERP source for Gitea deployment

app/modules/core/iam/scope_guard.py

@@ -0,0 +1,19 @@
+
+"""Scope guard utilities for tenant/branch enforcement (v2.0.3.1)"""
+
+from typing import Optional
+
+class ScopeError(Exception):
+    pass
+
+def ensure_same_tenant(actor_tenant_id: int, target_tenant_id: int):
+    if actor_tenant_id != target_tenant_id:
+        raise ScopeError("Cross-tenant operation is not allowed")
+
+def ensure_same_branch(actor_branch_id: int, target_branch_id: int):
+    if actor_branch_id != target_branch_id:
+        raise ScopeError("Cross-branch operation is not allowed")
+
+def validate_branch_belongs_to_tenant(branch_tenant_id: int, tenant_id: int):
+    if branch_tenant_id != tenant_id:
+        raise ScopeError("Branch does not belong to selected tenant")