fix: resolve SRS conflicts from batch verification analysis (CONFLICT-1~4)

Conflict Resolutions:
- CONFLICT-1 (High): Fix REQ-006 ownership scope — implement owner_user_id filtering
  * Change app/api/v1_assets.py: owner_user_id=None → owner_user_id=auth.user_id
  * Update docs/runtime-flows.md to reflect service-token owner-scoped portfolio filtering
  * Add regression test in tests/test_v1.py for ownership boundary

- CONFLICT-2 (Medium): Transition REQ-001/002/003 to Implemented
  * REQ-001: local-db-validation-scenarios (via confirm-req-implemented bat-007)
  * REQ-002: alembic-runtime-schema-ownership (via confirm-req-implemented bat-007)
  * REQ-003: local-db-operations-runbook-and-baseline-updates (via confirm-req-implemented bat-007)
  * Update docs/srs/index.md with status transitions

- CONFLICT-3 (Low): Document REQ-012 rotate lifecycle
  * Add rotate lifecycle notes to REQ-012 (change-req req-012)
  * Clarify runtime_id change behavior and trex-basic reconnection requirements

- CONFLICT-4 (Low): Clarify REQ-005 AC-2 endpoint path
  * Change REQ-005 AC-2: 'POST /auth/tokens or equivalent' → 'POST /auth/service-tokens'
  * Update docs/srs/index.md change log with change-req entries

Documentation Updates:
- Update BAT-001 verification status with conflict resolution evidence
- Update release rel-001 with verified status confirmation
- Add change log entries for all conflict resolutions with dates and references

Testing:
- Add ownership boundary test to test_v1.py
- Verify filter works with auth.user_id context

docs/releases/rel-001_20260502_trex-basic-v1-api-contract.md

@@ -10,7 +10,7 @@
   - BAT-001 (REQ-004, REQ-005, REQ-006, REQ-007, REQ-008, REQ-009, REQ-010)
   - GET /health 응답 스키마 확장 (service/version/checked_at 필드)
   - POST /auth/service-tokens — service-token 발급 + runtime_id 반환 API
-  - GET /v1/assets — 포트폴리오 목록 조회 (status 필터, strategy_params)
+  - GET /v1/assets — service-token 소유자 범위의 포트폴리오 목록 조회 (status 필터, strategy_params, owner scope 재확인 반영)
   - GET /v1/user_info — 사용자 정보 + broker credentials 복호화 반환
   - POST /v1/assets/{asset_id}/ledger/trades — 체결 기록 (idempotent: 201/200/409/404)
   - Fernet 암호화 유틸리티 (app/core/encryption.py)
@@ -29,6 +29,7 @@
 3. 서비스 재시작 (`uvicorn app.main:app`)
 4. GET /health 호출로 기동 확인
 5. v1 smoke 테스트: GET /v1/assets, GET /v1/user_info (service-token 사용)
+6. GET /v1/assets smoke 검증 시 service-token 소유자의 portfolio만 반환되고 다른 사용자 소유 portfolio는 포함되지 않는지 확인
 
 ## Rollback Plan
 
@@ -52,6 +53,7 @@
 - [ ] GET /health → `checked_at`에 `+09:00` 포함 확인
 - [ ] POST /auth/service-tokens (admin 토큰) → 201, `runtime_id` 포함 확인
 - [ ] GET /v1/assets (service-token) → 200, `assets[]` 반환 확인
+- [ ] GET /v1/assets (service-token) → service-token 소유자의 portfolio만 반환되고 다른 사용자 portfolio가 비노출인지 확인 (REQ-006 owner scope 재확인)
 - [ ] GET /v1/user_info (service-token) → 200, `trading_enabled`/`brokers[]` 포함 확인
 - [ ] POST /v1/assets/{asset_id}/ledger/trades → 201 (신규), 200 (중복 동일 payload) 확인
 - [ ] 서비스 startup 로그에 RuntimeError 없음 확인