fix(security): enforce VM access control on status endpoints; fix CI artifact upload

- get_vm_status and get_container_status were missing require_vm_access(),
  allowing any user with vms.view to see any VM status regardless of ownership.
  Now users with vms.view.own can only access their own VMs (403 otherwise).
- Downgrade upload-artifact@v4 → @v3: v4 is not supported on Gitea (GHES)
  and caused CI failures on every run.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

.github/workflows/backend-tests.yml

@@ -50,7 +50,7 @@ jobs:
 
       - name: Upload coverage artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v3
         with:
           name: backend-coverage-${{ matrix.python-version }}
           path: backend/coverage.xml