fix(#283): Enforce connection status validation in queries

Move status validation from post-retrieval checks into Prisma WHERE
clauses. This prevents TOCTOU issues and ensures only ACTIVE
connections are retrieved. Removed redundant status checks after
retrieval in both query and command services.

Security improvement: Enforces status=ACTIVE in database query rather
than checking after retrieval, preventing race conditions.

Fixes #283

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

apps/api/src/federation/command.service.ts

@@ -41,19 +41,19 @@ export class CommandService {
     commandType: string,
     payload: Record<string, unknown>
   ): Promise<CommandMessageDetails> {
-    // Validate connection exists and is active
+    // Validate connection exists and is active (enforced in query)
     const connection = await this.prisma.federationConnection.findUnique({
-      where: { id: connectionId, workspaceId },
+      where: {
+        id: connectionId,
+        workspaceId,
+        status: FederationConnectionStatus.ACTIVE,
+      },
     });
 
     if (!connection) {
       throw new Error("Connection not found");
     }
 
-    if (connection.status !== FederationConnectionStatus.ACTIVE) {
-      throw new Error("Connection is not active");
-    }
-
     // Get local instance identity
     const identity = await this.federationService.getInstanceIdentity();
 
@@ -132,7 +132,7 @@ export class CommandService {
       throw new Error("Command timestamp is outside acceptable range");
     }
 
-    // Find connection for remote instance
+    // Find connection for remote instance (status enforced in query)
     const connection = await this.prisma.federationConnection.findFirst({
       where: {
         remoteInstanceId: commandMessage.instanceId,
@@ -144,11 +144,6 @@ export class CommandService {
       throw new Error("No connection found for remote instance");
     }
 
-    // Validate connection is active
-    if (connection.status !== FederationConnectionStatus.ACTIVE) {
-      throw new Error("Connection is not active");
-    }
-
     // Verify signature
     const { signature, ...messageToVerify } = commandMessage;
     const verificationResult = await this.signatureService.verifyMessage(