docs: add ownership verification and collection lookup patterns to DEVELOPMENT.md

[moltboie]

Changes

Adds two new patterns to the Design Patterns section of DEVELOPMENT.md:

Resource Ownership Verification

Documents that every delete/update route must verify the resource belongs to the authenticated user. Highlights the gap between repository-level softDelete (which operates by primary key only) and proper user-scoped operations.

Collection Lookup Performance

Documents the anti-pattern of using .find() inside loops (O(n²)) and the preferred Set/Map approach (O(n)) for matching items across collections during sync operations.

Context

• Related issues: security: IDOR vulnerability — update/delete operations lack user ownership verification #168 (IDOR), perf: O(n²) transaction matching in sync causes slowdown with large datasets #200 (O(n²) sync), reliability: sync operations are non-atomic — partial failure leaves inconsistent state #202 (non-atomic sync)
• Pattern extracted from existing good examples (deleteAccounts in accounts.ts)

E2E Testing

Documentation-only change. Verified markdown renders correctly and no code changes.

[moltboie]

Self-Review

Discussion thread status:

• New PR. No docs-only change — adds two patterns to DEVELOPMENT.md: resource ownership verification and collection lookup pattern.

Checked:

• Accuracy: Ownership verification pattern correctly documents that softDelete/update accept a primaryKey object — callers must pass user_id to scope the query to the authenticated user. Examples look correct.
• Collection lookup pattern: Documents building a Map for O(1) lookups instead of find(). Consistent with budget/perf: replace O(n²) transaction matching with O(n) Map/Set lookups #205 perf fix.
• No code changes: Documentation only.

Issues found:

• None.

Confidence: High

[hoiekim]

Resolve conflicts @moltboie

[moltboie]

Conflicts resolved and rebased on main. Kept both the new content from upstream (Typed Result Pattern, SimpleFin, Accessibility, Timer Cleanup sections) and this PR's additions (Resource Ownership Verification and Collection Lookup Performance). Force-pushed.