Issue: User-facing listing methods don't enforce access control

Issue: User-facing listing methods don't enforce access control: a task in LegoFlow-SWE (Harbor dataset). The alarm, rules engine, and reports modules do not apply access control when a user requests a list of entities they should be able to see. Any authenticated user can currently retrieve all…

The task

The alarm, rules engine, and reports modules do not apply access control when a user requests a list of entities they should be able to see. Any authenticated user can currently retrieve all alarms, rules, and report configurations across every domain, regardless of their actual permissions or domain membership.

Part of Lego-X/LegoFlow-SWE.