Scope /mycards and dashboard to own cards only

The Directus read permission intentionally allows friends' collections
(used by /friends/[username]); the own-collection pages need an explicit
user = current-user filter on top of it.

src/pages/index.astro

@@ -14,9 +14,13 @@ if (!isLoggedIn(Astro.locals)) {
     return Astro.redirect("/login");
 }
 
-// Owner-scoping is enforced by the Directus permissions
+// Own cards only (the read permission also allows friends' collections,
+// which is what /friends/[username] uses — here we want just ours)
 const myCards = (await directus!.request(
-    readItems("mycards", { limit: -1 }),
+    readItems("mycards", {
+        filter: { user: { _eq: Astro.locals.user!.id } },
+        limit: -1,
+    }),
 )) as MyCardRecord[];
 
 // Fetch prices through the 24h-cached card endpoint

src/pages/mycards.astro

@@ -13,9 +13,14 @@ if (!isLoggedIn(Astro.locals)) {
     return Astro.redirect("/login");
 }
 
-// Fetch all user's cards (owner-scoping enforced by Directus permissions)
+// Own cards only (the read permission also allows friends' collections,
+// which is what /friends/[username] uses — here we want just ours)
 const myCards = (await directus!.request(
-    readItems("mycards", { sort: ["-date_created"], limit: -1 }),
+    readItems("mycards", {
+        filter: { user: { _eq: Astro.locals.user!.id } },
+        sort: ["-date_created"],
+        limit: -1,
+    }),
 )) as MyCardRecord[];
 
 const cardsWithPrice = await priceCollectionCards(myCards);