fix: add /posts/{slug} detail route so post titles resolve

Post cards on the home page have linked to /posts/<slug> since
Phase 1 (per the partial's inline comment), but the matching route
and template were never registered — clicking a post title returned
a JSON 404 from FastAPI. This adds:

- PostService.get_published_by_slug() — status-filtered, parameterized
  read that treats "draft" and "unknown slug" as the same 404 so
  unpublished titles cannot be enumerated via URL guessing.
- GET /posts/{slug} public route that 404s on miss.
- public/post.html detail template mirroring about.html's safe-render
  pattern for the bleach-sanitized body_html_cached.
- Supporting .page-article__date / .page-article__back CSS.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/static/css/site.css

@@ -348,6 +348,17 @@ a:focus-visible {
   margin-bottom: var(--space-2);
 }
 
+.page-article__date {
+  font-size: 0.875rem;
+  color: var(--c-sky-deep);
+  font-family: var(--font-sans);
+}
+
+.page-article__back {
+  margin-top: var(--space-4);
+  max-width: 48rem;
+}
+
 /* Post list + card. */
 .post-list {
   display: grid;