Cross-provider appointment writes via unchecked provider ID

Authorization bypass in Easy!Appointments before 1.6.0 allows remote authenticated users to write appointments into another provider's calendar. The appointments/store and appointments/update handlers persist attacker-controlled id_users_provider values after checking only generic appointment privileges. Provider access in a multi-provider deployment is sufficient to create or reassign records across provider boundaries; store commits the unauthorized row before returning an error.