Backfill team on unstamped venues, then refuse them in validate_venue_team

[harshtandiya]

Context

PR #354 adds BuzzEvent.validate_venue_team, which refuses an event that links a venue belonging to another team. Without it, a manager could name another team's venue — Event Venue is autonamed by prompt, so docnames are guessable — and that venue's address would then be published through the booking confirmation (buzz/api/booking/details.py:68) and the calendar invite (buzz/utils.py:182). Both dereference the linked venue without a permission check.

The guard deliberately abstains when the venue carries no team:

venue_team = frappe.db.get_value("Event Venue", self.venue, "team")
if venue_team and venue_team != self.team:
    frappe.throw(_("Venue {0} belongs to another team.").format(self.venue))

A review flagged the abstain: an unstamped venue is linkable by any team, which is the same leak narrowed to legacy rows. That is correct as written.

Why it is being handled separately

Tightening the guard to if venue_team != self.team would refuse an unstamped venue outright. That is the right end state, but it turns a data problem into a save failure: any site still holding such a row would find those events unsaveable, including edits unrelated to the venue. The data should be corrected first, and the guard tightened afterwards.

What to do

Add a patch that stamps a team on every Event Venue still without one, in the manner of the existing team backfills:

buzz.patches.create_default_teams #2
buzz.patches.assign_default_team #2
buzz.patches.create_team_settings_for_existing_teams

Then tighten validate_venue_team to drop the truthiness check, and flip the existing test test_a_venue_without_a_team_is_accepted in buzz/events/doctype/buzz_event/test_buzz_event.py to expect a ValidationError.

Worth knowing before starting

buzz.patches.assign_default_team already covers Event Venue — TEAM_DIRECT_DOCTYPES includes it, and the patch sets the site's first owned team on every row where team is null or empty. It is logged as applied, team is reqd: 1 on the doctype, and neither buzz.localhost nor testbuzz.localhost currently has an unstamped venue.

So this may be less about writing a new backfill than about confirming the existing one left nothing behind on real sites, and deciding whether a re-run (a #3 bump) is warranted before the guard is tightened. The remaining ways a null team could appear are a direct database write or an insert with ignore_mandatory.

Acceptance

• No Event Venue rows with a null or empty team on a migrated site.
• validate_venue_team refuses an unstamped venue.
• The doctype test asserts the refusal.