fix(ads): verify a message belongs to its campaign before edit/delete

DeleteMessage/EditMessage acted on the message id without checking it belonged
to the campaign id in the URL. A mismatched pair could edit an unrelated
campaign's message or — worse — delete the default campaign's last message via
another campaign's URL, bypassing the "default keeps >=1 message" guard. Both
now load the campaign and return ErrNotFound unless it owns the message
(MoveMessage already did). Operator-only, but a real business-logic bypass.
Regression test: TestBannerMessageOwnership.

backend/internal/server/handlers_admin_banners.go

@@ -159,7 +159,7 @@ func (s *Server) consoleEditBannerMessage(c *gin.Context) {
 		return
 	}
 	back := "/_gm/banners/" + cid.String()
-	if err := s.ads.EditMessage(c.Request.Context(), mid, trimForm(c, "body_en"), trimForm(c, "body_ru")); err != nil {
+	if err := s.ads.EditMessage(c.Request.Context(), cid, mid, trimForm(c, "body_en"), trimForm(c, "body_ru")); err != nil {
 		s.bannerError(c, err, back)
 		return
 	}