docs(security): strengthen API guidance

shared/rules/security/references/api.md

@@ -1,7 +1,12 @@
 # API security
 
 * Authenticate and authorize protected endpoints; validate every request payload and identifier.
+* Enforce object-level authorization on every read and write, using the authenticated principal and resource ownership at the operation that accesses the data.
+* Bind only explicitly permitted request fields. Do not allow mass assignment of ownership, role, state, or other privileged properties.
 * Bound request and response sizes, pagination, query results, and expensive operations.
-* Apply rate limits where abuse is plausible and keep administrative endpoints separately protected.
-* Return only authorized data and never expose stack traces, internal models, or implementation details in API errors.
-* Prefer explicit DTOs and schemas over deserializing arbitrary types or executable objects.
+* Apply rate limits and quotas to authentication, search, uploads, expensive operations, and other abuse-prone endpoints. Keep administrative routes separately protected.
+* Define safe retry and idempotency behavior for state-changing requests. Protect against replay and duplicate side effects where relevant.
+* Return only authorized fields. Do not expose stack traces, internal models, secrets, or implementation details in API responses or errors.
+* Prefer explicit DTOs and schemas; reject unknown or ambiguous fields when accepting them could alter privileged state.
+* Keep authorization, validation, serialization, and error responses consistent with the published schema and supported clients.
+* Test malformed, oversized, unauthenticated, unauthorized, cross-user, cross-tenant, and duplicate requests within the approved scope.