fix(blog): hide drafts at the access layer, and back the --drop claim

Review findings on #140.

Drafts were reachable. Posts granted unconditional public read and the
_status filter lived only in the pages that query the collection — which
is a convenience, not a control. Payload's documentation is explicit:
"The `draft` argument alone does not restrict documents with _status:
'draft' from being returned by the API." A direct GET /cms-api/posts
would have handed every unpublished draft to any visitor. Read access
now returns a query constraint for anonymous callers, which is the
documented mechanism.

The --drop claim was asserted across four files while the spec still
listed it as an open question. Now verified rather than assumed:
run_full_migration drops exactly ["school_results", "schools"] by name,
there is no drop_all() or DROP SCHEMA anywhere in backend/, the only
other drop is schema-qualified to marts, and nothing sets search_path.
The guarantee is stronger than schema isolation alone — those two table
names do not exist in Payload — so the claim stands, but it now rests on
cited code. The spec records the evidence and closes the open item.

findPost is wrapped in React's cache(): Next calls generateMetadata and
the page separately for one request, so every post view ran the same
query against Postgres twice.

The bare .lede rule was dead — .prose p scores (0,1,1) and outranks it —
so only .prose .lede ever applied. Removed, with the specificity noted
so the surviving selector is not "simplified" back into a silent
regression.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017YmbBhr8s7GusjDE12hrZM

nextjs-app/app/(frontend)/about/About.module.css

@@ -54,12 +54,11 @@
 }
 
 /* The opening paragraph carries the page. Larger, and in the primary ink
-   rather than the secondary, so it reads as a voice rather than as body copy. */
-.lede {
-  font-size: 1.125rem;
-  color: var(--text-primary);
-}
+   rather than the secondary, so it reads as a voice rather than as body copy.
 
+   Must stay in the descendant form: `.prose p` scores (0,1,1) and would beat a
+   bare `.lede` at (0,1,0), so simplifying this selector silently reverts the
+   lede to ordinary body copy. */
 .prose .lede {
   font-size: 1.125rem;
   color: var(--text-primary);