API: allow reads to filter by client_id on top of RBAC client scoping

The RBAC rework dropped the client_id read filter along with per-key client scope, so an all-clients key could no longer narrow to one client. apiClientScopeSql() now appends the filter after the scope fragment, so it can only narrow, never widen. Reads only - writes take client_id as their target client.

api/v1/invoice_items/read.php

@@ -10,17 +10,17 @@
  *   invoice_id     required* - Return items for a single invoice
  *   item_id        required* - Return a single line item by its own ID
  *                  * One of invoice_id or item_id must be provided
+ *   client_id      optional  - Only return items on invoices for this client
  *   limit          optional  - Max rows to return (default 50)
  *   offset         optional  - Offset for pagination (default 0)
  *
  * Security:
  *   - invoice_items are always joined to invoices so that invoice_client_id
- *     is checked against the API key's client scope. A scoped key can never
+ *     is checked against the key user's client scope. A restricted key can never
  *     read items belonging to another client, even when item_id is supplied
  *     directly.
- *   - $client_id is set to "%" by validate_api_key.php for All-Clients keys,
- *     which causes the LIKE to match every client — consistent with other
- *     endpoints in this API.
+ *   - An optional client_id narrows the result further, within that scope. It is
+ *     a filter, not a grant - it can never widen what the key can see.
  */
 require_once '../validate_api_key.php';
 require_once '../require_get_method.php';