Scope and access

• User-scoped timers are private to the authenticated user.
• Team-scoped timers can only be listed or managed by a team owner.
• Repo-scoped timers can be listed and fetched by users with repo read access; creating, updating, or deleting one requires maintainer access.
• A timer UUID is only reachable through its owning user, team, or repo scope.