fix: restore shared map access and publish accepted administrative boundary projection

app/Http/Controllers/InvestmentTerritoryController.php

@@ -19,12 +19,21 @@ class InvestmentTerritoryController extends Controller
         $data = $request->validate(['territory_id' => ['required', 'uuid']]);
         $profile = $request->is('minhas-oportunidades/*');
         $management = $request->is('management/*') || $profile;
+        $actor = $request->user();
+        $access = app(PortalProfileAccess::class);
+        // The general consumers use this same endpoint while authenticated.
+        // Reuse the read access already granted by the private cadastral routes.
+        $profileAccess = $actor && $actor->hasVerifiedEmail()
+            && ($access->grants($actor) !== [] || $access->superuser($actor));
+        $internal = $profileAccess || ($actor?->hasVerifiedEmail() && $actor->can('manage-portal'));
         if ($management) {
-            $access = app(PortalProfileAccess::class);
-            abort_unless($profile ? ($access->grants($request->user()) !== [] || $access->superuser($request->user())) : $request->user()?->can('manage-portal'), 403);
+            abort_unless($profile ? $profileAccess : $internal, 403);
         }
 
-        return response()->json(app(TerritoryGeometry::class)->context($data['territory_id'], $management));
+        return response()->json([
+            ...app(TerritoryGeometry::class)->context($data['territory_id'], $internal),
+            'geometry_scope' => $internal ? 'authorized_internal' : 'public',
+        ])->header('Cache-Control', 'private, no-store');
     }
 
     private const TABLES = ['opportunities' => 'opportunities', 'projects' => 'projects', 'clusters' => 'economic_clusters', 'corridors' => 'development_corridors', 'zones' => 'investment_zones'];