feat(15-03): enforce JOURNAL-005 draft 404 and backend-Bearer writes

- Show unpublished or future posts as 404 without a data key unless owner or access_other_posts
- POST/PUT/DELETE posts and featured-images require a backend-audience JWT and PHP {error} strings
- Anonymous GET categories and tags return the PHP list keys; frontend-audience tokens cannot write

Co-authored-by: Cursor <cursoragent@cursor.com>

controllers/api/auth.go

@@ -19,7 +19,10 @@ const (
 	errPublishPermission      = "You do not have permission to publish posts"
 	errEditPermission         = "You do not have permission to edit this post"
 	errPostNotFound           = "Post not found"
+	errImageNotFound          = "Image not found"
 	errValidationFailed       = "Validation failed"
+	msgPostDeleted            = "Post deleted"
+	msgImageRemoved           = "Image removed"
 
 	permAccessPosts      = "golem15.journal.access_posts"
 	permAccessOtherPosts = "golem15.journal.access_other_posts"
@@ -32,6 +35,13 @@ func writeAPIError(w http.ResponseWriter, status int, message string) {
 	wire.WriteJSON(w, status, map[string]any{"error": message})
 }
 
+func writeValidation(w http.ResponseWriter, errs map[string][]string) {
+	wire.WriteJSON(w, http.StatusUnprocessableEntity, map[string]any{
+		"error":  errValidationFailed,
+		"errors": errs,
+	})
+}
+
 func writeAuthRequired(w http.ResponseWriter, _ error) {
 	writeAPIError(w, http.StatusUnauthorized, errAuthenticationRequired)
 }