refactor(auth): centralize project/workspace authorization with checkProjectAccess across API routes

app/api/projects/[projectId]/videos/[videoId]/versions/[versionId]/route.ts

@@ -1,7 +1,6 @@
 import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
-import { auth } from '@/lib/auth';
-import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
+import { auth, checkProjectAccess } from '@/lib/auth';
 import { rateLimit } from '@/lib/rate-limit';
 import { cleanupBunnyStreamVideos } from '@/lib/bunny-stream-cleanup';
 import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
@@ -14,16 +13,7 @@ async function getVersionWithAccess(projectId: string, videoId: string, versionI
         include: {
             video: {
                 include: {
-                    project: {
-                        include: {
-                            members: { where: { userId } },
-                            workspace: {
-                                include: {
-                                    members: { where: { userId } },
-                                },
-                            },
-                        },
-                    },
+                    project: true,
                 },
             },
         },
@@ -34,14 +24,9 @@ async function getVersionWithAccess(projectId: string, videoId: string, versionI
     }
 
     const project = version.video.project;
-    const isOwner = project.ownerId === userId;
-    const membership = project.members[0];
-    const workspaceMembership = project.workspace.members[0];
-    const canEdit = isOwner ||
-        membership?.role === ProjectMemberRole.ADMIN ||
-        workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
+    const access = await checkProjectAccess(project, userId, { intent: 'manage' });
 
-    return { version, canEdit, isOwner };
+    return { version, canEdit: access.canEdit, isOwner: access.isOwner };
 }
 
 // PATCH /api/projects/[projectId]/videos/[videoId]/versions/[versionId]