Fix null-safety + ballot-integrity bugs; web_engine clean at PHPStan level 8

Resolves the final 7 level-8 findings, all genuine (not annotation gaps):

- BallotController::vote()/voteComponent(): removed a redundant, null-unsafe
  re-fetch `Vote::find(['code'=>..,'ballot_id'=>..])->first()` (find() with an
  array treats the values as primary keys, so ballot_id was ignored and the
  result was ?Vote used unguarded). The vote is already fetched and validated
  at the top of each method; reuse it.
- SECURITY: the guard `!$vote->ballot->id == $ballot->id` had an operator-
  precedence bug (`!$vote->ballot->id` bound first), making the ballot-match
  check dead code — a voting code for one ballot could be submitted against
  another. Fixed to `$vote->ballot->id !== $ballot->id`.
- Controller::getOwner(): Auth::user() is ?ApiUser; narrowed via @var (all
  callers run behind auth.api middleware, so non-null at runtime).
- BallotService::resultsCsv(): pass `$vote->values ?? []` to valuesToCsv()
  (castVotes() already filters non-null, so the fallback never triggers).

web_engine now passes PHPStan level 8 (domain code; framework scaffolding
excluded) with zero baseline/ignore entries. Tests: 24 passed.

Author: Putr

app/Http/Controllers/BallotController.php

@@ -29,7 +29,7 @@ public function view(Election $election, Ballot $ballot, Request $request, Ballo
         /** @var Vote|null $vote */
         $vote = Vote::find($code);
 
-        if (!$vote || !$vote->ballot->id == $ballot->id) {
+        if (!$vote || $vote->ballot->id !== $ballot->id) {
             return view('404', ['code' => 404]);
         }
 
@@ -62,7 +62,7 @@ public function vote(Election $election, Ballot $ballot, Request $request): View
         /** @var Vote|null $vote */
         $vote = Vote::find($code);
 
-        if (!$vote || !$vote->ballot->id == $ballot->id) {
+        if (!$vote || $vote->ballot->id !== $ballot->id) {
             return view('404', ['code' => 404]);
         }
 
@@ -81,9 +81,7 @@ public function vote(Election $election, Ballot $ballot, Request $request): View
             return view('vote-failed', ['election' => $election, 'ballot' => $ballot, 'errors' => $errors]);
         }
 
-        $code = $request->input('code');
         $values = $request->except(['code', '_token']); // Could get the component slugs and say ->only
-        $vote = Vote::find(['code' => $code, 'ballot_id' => $ballot->id])->first();
         $vote->values = $values;
         $vote->save();
 
@@ -101,7 +99,7 @@ public function voteComponent(Election $election, Ballot $ballot, BallotComponen
         /** @var Vote|null $vote */
         $vote = Vote::find($code);
 
-        if (!$vote || !$vote->ballot->id == $ballot->id) {
+        if (!$vote || $vote->ballot->id !== $ballot->id) {
             return view('404', ['code' => 404]);
         }
 
@@ -120,9 +118,6 @@ public function voteComponent(Election $election, Ballot $ballot, BallotComponen
             return view('vote-failed', ['election' => $election, 'ballot' => $ballot, 'errors' => $errors]);
         }
 
-        $code = $request->input('code');
-        $vote = Vote::find(['code' => $code, 'ballot_id' => $ballot->id])->first();
-
         $values = $request->except(['code', '_token']); // Could get the component slugs and say ->only
         $oldValues = $vote->values;
         if (!is_array($oldValues)) {

app/Http/Controllers/Controller.php

@@ -53,6 +53,10 @@ public function basicResponse(int $code = 200, array $extra = []): \Illuminate\H
 
     protected function getOwner(): string
     {
-        return Auth::user()->owner;
+        // Routes calling getOwner() run behind the auth.api middleware, which
+        // logs in an ApiUser, so Auth::user() is never null here.
+        /** @var \App\Models\ApiUser $user */
+        $user = Auth::user();
+        return $user->owner;
     }
 }

app/Services/BallotService.php

@@ -138,7 +138,7 @@ public function resultsCsv(Ballot $ballot): string
         $results_per_component = $components->map(function (BallotComponent $component) use ($votes) {
             $componentClass = $this->getBallotComponentClassInstance($component['type'], $component['version'], $component['settings']);
             return $votes->map(function (Vote $vote) use ($componentClass, $component) {
-                return $componentClass::valuesToCsv($vote->values, $component->id);
+                return $componentClass::valuesToCsv($vote->values ?? [], $component->id);
             });
         });