Scope staff Care queries to the organization owner_ref.

Demo doctors were querying their own public_id, so branches/patients/queues looked empty even though the Pro tenant had data.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Api/Concerns/ScopesApiToAccount.php

@@ -11,7 +11,16 @@ use Illuminate\Http\Request;
 
 trait ScopesApiToAccount
 {
+    /**
+     * Tenant data owner — always the organization owner_ref.
+     * Staff API tokens must scope to the employer tenant, not the staff public_id.
+     */
     protected function ownerRef(Request $request): string
+    {
+        return (string) $this->organization($request)->owner_ref;
+    }
+
+    protected function actorRef(Request $request): string
     {
         return (string) $request->user()->public_id;
     }