Scope staff Care queries to the organization owner_ref.

Demo doctors were querying their own public_id, so branches/patients/queues looked empty even though the Pro tenant had data.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Care/Concerns/ScopesToAccount.php

@@ -12,7 +12,17 @@ use Illuminate\Http\Request;
 
 trait ScopesToAccount
 {
+    /**
+     * Tenant data owner — always the organization owner_ref.
+     * Staff members must read/write the employer's records, not their own public_id.
+     */
     protected function ownerRef(Request $request): string
+    {
+        return (string) $this->organization($request)->owner_ref;
+    }
+
+    /** Acting user (audit / created_by), distinct from the tenant owner. */
+    protected function actorRef(Request $request): string
     {
         return (string) $request->user()->public_id;
     }

app/Http/Controllers/Care/MemberController.php

@@ -149,13 +149,13 @@ class MemberController extends Controller
         $this->authorizeAbility($request, 'admin.members.manage');
         $this->authorizeOwner($request, $member);
 
-        abort_if($member->user_ref === $this->ownerRef($request), 422, 'You cannot remove yourself.');
+        abort_if($member->user_ref === $this->actorRef($request), 422, 'You cannot remove yourself.');
 
         $memberId = $member->id;
         $organizationId = $member->organization_id;
         $member->delete();
 
-        AuditLogger::record($this->ownerRef($request), 'member.deleted', $organizationId, $this->ownerRef($request), Member::class, $memberId);
+        AuditLogger::record($this->ownerRef($request), 'member.deleted', $organizationId, $this->actorRef($request), Member::class, $memberId);
 
         return redirect()->route('care.members.index')->with('success', 'Member removed.');
     }