lawyered0 closes a back door on shared document reviews

Collaborators could quietly rename a review or swap out its documents by going straight to the API, even though the screen treats those as the owner's call.

In Mike's tabular review feature - the grid where a team runs a set of documents through a column of questions - the owner is supposed to control the structural settings. The interface already locks down who can rename a review, add or remove documents, change who it's shared with, or move it between projects. But two of those controls only looked locked. Anyone with access to a shared review could rename it, or add and remove documents (and everything hanging off them), simply by calling the backend directly.

lawyered0's patch requires review ownership before the title or the document list can change, so the backend now enforces the same owner-versus-collaborator line the screen has always implied. The existing protections on columns, sharing, and project moves are left as they were.