fix(equipment): verify booked-for member belongs to caller's space (L1)

reserveEquipment used a manager-supplied memberId directly, so a booking could
be stamped for a member id from another space. Mirror signUpForClass: look up
the target by (id, space_id=caller) and reject if absent.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/actions/equipment.ts

@@ -257,6 +257,20 @@ export async function reserveEquipment(input: unknown) {
   if (!equip) return { error: 'Equipment not found' }
 
   const admin = createAdminClient()
+
+  // When booking on someone else's behalf, the target must belong to the
+  // caller's space, mirroring signUpForClass. Without this a manager could
+  // pass a member id from another space and stamp a reservation there.
+  if (targetMemberId !== member.id) {
+    const { data: tgt } = await admin
+      .from('space_members')
+      .select('id')
+      .eq('id', targetMemberId)
+      .eq('space_id', member.space_id)
+      .maybeSingle()
+    if (!tgt) return { error: 'That member was not found in this space.' }
+  }
+
   const { data: existing } = await admin
     .from('equipment_reservations')
     .select('starts_at, ends_at, status')