feat: implement GET /v3/posts/{postId} with visibility-aware access control

[ondraholis]

Description:

The GET /v3/posts/{postId} endpoint existed in PostController but was unreachable and non-functional: the path fell through to the catch-all denyAll() security rule, and PostServiceImpl.findById() was an unimplemented stub returning null. This PR implements the endpoint to support the helpdesk integration middleware, which needs to fetch full post text by ID when relaying a negotiation.post.added webhook to the help desk.

The implementation applies the same visibility rules as the existing post-listing endpoint: public posts are readable by any negotiation participant; private posts are only accessible to the negotiation creator, admins, helpdesk integration callers, or participants whose organization matches the post's target organization. Callers holding ROLE_HELPDESK_INTEGRATION bypass the negotiation participant check entirely, as the middleware must be able to relay any post regardless of which organization it is addressed to.

The PR covers Change 4 from integration plan as described in helpdesk-integration-plan.md.

Checklist:

Required for all pull requests:

• I have performed a self-review of my code
• I have made my code as simple as possible
• I have removed all commented code
• I have described the PR and added a meaningful title in the Conventional Commits format

If applicable to this PR:

• I have added relevant tests for my changes and the code coverage has not dropped substantially
• I have updated the documentation in all relevant places (Javadoc, Swagger, MDs...)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud