Data Export Project Authorization

Export creation, download and job-status subscription require the owning project's existing ExportData permission. Its default grant is project owner or administrator. Ordinary project view access does not grant access to exported screening and annotation records.

The REST controller applies ProjectExportDataPolicy to both actions. Creation validates that the request project matches the route project before saving a job. Download validates that the stored job belongs to the route project before reading study data, returning the same not-found response for absent and mismatched jobs.

SubscribeToDataExportJob(jobId) retains its existing client signature. Its dedicated SignalR policy resolves the job's stored project and applies the same ExportData activity before the subscription manager is invoked. Missing jobs and projects are denied. Unsubscribe removes only the calling connection's subscription and remains available for cleanup.

This correction uses existing permission grants and does not change export formats, blinding, source cursor counts, progress or the statistics materialization contract. Tests execute both production authorization handlers with owner, administrator, ordinary-member and unrelated-user fixtures, check missing-resource refusal and route binding, and retain successful create/download behavior and CSV escaping coverage.