Fix: publisher pages are owner-private
- A `publisher`-access page is now readable only by its owner (and admin). Previously any logged-in user could open another publisher's page by its URL, even though it never appeared in their dashboard — page serving now matches the listing's scope.
- Authenticated non-owners get a `404` (existence not leaked); anonymous viewers are still sent to login so an owner can authenticate via a share link.