fix(security): enforce VM access control on status endpoints; fix CI artifact upload

- get_vm_status and get_container_status were missing require_vm_access(),
  allowing any user with vms.view to see any VM status regardless of ownership.
  Now users with vms.view.own can only access their own VMs (403 otherwise).
- Downgrade upload-artifact@v4 → @v3: v4 is not supported on Gitea (GHES)
  and caused CI failures on every run.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

.github/workflows/backend-tests.yml

@@ -50,7 +50,7 @@ jobs:
 
       - name: Upload coverage artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v3
         with:
           name: backend-coverage-${{ matrix.python-version }}
           path: backend/coverage.xml

backend/app/api/proxmox/vms.py

@@ -1642,16 +1642,17 @@ def get_vm_status(
     current_user: User = Depends(PermissionChecker("vms.view"))
 ):
     """Получить детальный статус VM (CPU, RAM, Disk, Network)"""
+    require_vm_access(db, current_user, server_id, vmid)
     server = db.query(ProxmoxServer).filter(ProxmoxServer.id == server_id).first()
     if not server:
         raise HTTPException(status_code=404, detail="Proxmox server not found")
-    
+
     try:
         client = _get_proxmox_client(server)
-        
+
         if not client.is_connected():
             raise HTTPException(status_code=503, detail="Failed to connect to Proxmox server")
-        
+
         status = client.get_vm_status(node, vmid)
         return JSONResponse(content=status)
     except Exception as e:
@@ -1668,16 +1669,17 @@ def get_container_status(
     current_user: User = Depends(PermissionChecker("vms.view"))
 ):
     """Получить детальный статус LXC контейнера"""
+    require_vm_access(db, current_user, server_id, vmid)
     server = db.query(ProxmoxServer).filter(ProxmoxServer.id == server_id).first()
     if not server:
         raise HTTPException(status_code=404, detail="Proxmox server not found")
-    
+
     try:
         client = _get_proxmox_client(server)
-        
+
         if not client.is_connected():
             raise HTTPException(status_code=503, detail="Failed to connect to Proxmox server")
-        
+
         status = client.get_container_status(node, vmid)
         return JSONResponse(content=status)
     except Exception as e: