fix(api): enforce ownership check on AI generation endpoint

[MinitJain]

Summary

• GET /api/video/ai authenticated the caller but never verified they own the target video
• Any authenticated user could pass ?videoId=<any_video_id> and trigger AI generation billed to the video owner's account
• Added eq(videos.ownerId, user.id) to the DB query — non-owners get a 404 (same as "not found"), so the existence of other users' videos is not leaked

Security Impact

This is an IDOR (Insecure Direct Object Reference). An attacker with a free account could exhaust another user's paid AI generation quota by repeatedly triggering generation on their videos.

Test plan

• Owner can trigger AI generation on their own video (existing behavior unchanged)
• Authenticated non-owner gets 404 when passing another user's video ID
• Unauthenticated request still gets 401