Cross-staff appointment disclosure via unchecked ID

Insecure direct object reference in Bookly 27.7 and earlier allows remote authenticated users to read other staff appointments. The Mobile Staff Cabinet appointment() handler in frontend/modules/mobile_staff_cabinet/api/handlers/Handler1_0.php loads params[id] and returns Appointment and customer_appointments data without verifying that the appointment's staff_id matches the authenticated staff token. Any valid Mobile Staff Cabinet access_key bound to a Staff entity is sufficient, so staff users can enumerate sequential appointment IDs and expose customer contact, note, custom-field, extras, and payment-status data for other staff members.