[WEB-8400] test: cover same-workspace/other-project board scope (CodeRabbit #9481)

The negative cases all used a different workspace, so they'd pass even if the
project predicate were dropped from get_queryset (workspace slug alone would
catch them). Add a board for a different project in the SAME workspace and assert
it 404s via project_a's URL, guarding the project_id/entity_identifier scope.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/plane/tests/contract/app/test_deploy_board_cross_workspace_scope_app.py

@@ -50,6 +50,19 @@ def own_board(db, workspace, project_a):
     return _board_for(workspace, project_a)
 
 
+@pytest.fixture
+def sibling_board(db, workspace, create_user):
+    """A board for a DIFFERENT project in the SAME workspace as project_a.
+
+    Guards the project predicate specifically: a workspace-slug-only scope would
+    still expose this board through project_a's URL.
+    """
+    other = Project.objects.create(
+        name="Sibling Project", identifier="SIB", workspace=workspace, created_by=create_user
+    )
+    return _board_for(workspace, other)
+
+
 @pytest.fixture
 def victim_board(db):
     """A published board in a DIFFERENT workspace the caller has no relation to."""
@@ -94,6 +107,15 @@ class TestDeployBoardCrossWorkspaceScope:
         victim_board.refresh_from_db()
         assert victim_board.is_comments_enabled is False
 
+    def test_cannot_retrieve_same_workspace_other_project_board(
+        self, session_client, workspace, project_a, sibling_board
+    ):
+        """A board in the same workspace but a different project must 404 via project_a's URL."""
+        response = session_client.get(_board_url(workspace.slug, project_a.id, sibling_board.id))
+        assert response.status_code == status.HTTP_404_NOT_FOUND, (
+            f"Got {response.status_code}: {getattr(response, 'data', None)!r}"
+        )
+
     def test_can_retrieve_own_board(self, session_client, workspace, project_a, own_board):
         """Positive control: a project member may retrieve their own board."""
         response = session_client.get(_board_url(workspace.slug, project_a.id, own_board.id))