API returns timesheet entries a user should not be authorized to view

Kimai's API incorrectly returns all timesheet entries to users who should only see timesheets from their teams, even though the web interface correctly restricts this data. This means sensitive time-tracking information can be accessed by unauthorized users through the API.

A permission check inconsistency exists between Kimai's frontend and API implementations for the `view_other_timesheet` permission. The API endpoint fails to enforce team-based filtering when returning timesheet entries, allowing authenticated users with `view_other_timesheet` enabled to retrieve all timesheets regardless of team membership, while the UI correctly restricts visibility to team-scoped entries. The vulnerability affects confidentiality of time-tracking data across the application.