fix(middleware): log ownership lookup failures; drop dead auth surface

ownership.js caught a lookup failure, returned 500 and logged nothing -- the
file had no logger import, so a failing ownership check was invisible in the
logs. Added logging matching photoAuth.js/permissions.js
({ error, stack } plus the relevant id), response behaviour unchanged. Fixed
both swallowed catches: requireEventOwnership, the reported one, and the
byte-identical requireProjectOwnership.

Also removes AdminAuthContext.updatePasswordChanged, now dead -- superseded
by the deliberate full-page reload in onSuccess, with zero callers left.
setMustChangePassword and mustChangePassword stay; nothing else orphaned.

Refs testplan REPORT.md B13, B16.

backend/src/middleware/ownership.js

@@ -1,4 +1,5 @@
 const { db } = require('../database/db');
+const logger = require('../utils/logger');
 
 /**
  * Middleware to enforce event ownership for non-super_admin users.
@@ -27,7 +28,10 @@ function requireEventOwnership(req, res, next) {
       }
       next();
     })
-    .catch((_err) => {
+    .catch((err) => {
+      logger.error('Event ownership check failed', {
+        eventId, adminId: req.admin.id, error: err.message, stack: err.stack,
+      });
       res.status(500).json({ error: 'Failed to verify ownership' });
     });
 }
@@ -152,7 +156,12 @@ function requireProjectOwnership(req, res, next) {
       if (!row) return res.status(404).json({ error: 'Project not found' });
       next();
     })
-    .catch(() => res.status(500).json({ error: 'Failed to verify project ownership' }));
+    .catch((err) => {
+      logger.error('Project ownership check failed', {
+        projectId, adminId: req.admin?.id, error: err.message, stack: err.stack,
+      });
+      res.status(500).json({ error: 'Failed to verify project ownership' });
+    });
 }
 
 module.exports = {