fix: reading a single article follows the same rule as the list: anyone can read an online article, a verified user can also read an offline one, and an unknown or hidden id returns 404

features/not_found_errors.feature

@@ -11,6 +11,10 @@ Feature: Domain not-found errors instead of raw GORM errors
     And ArticleRepository.Get and ArticleRepository.GetByName return article.ErrArticleNotFound, not gorm.ErrRecordNotFound, when no row matches
     And UserRepository.Get, UserRepository.GetByUsername and UserRepository.GetByEmail return user.ErrUserNotFound, not gorm.ErrRecordNotFound, when no row matches
     And GET /v1/article/{id} sits behind the jwtauth Verifier and Authenticator group, and requires a valid jwt cookie
+    And a later slice, features/public_article_read.feature, moves GET /v1/article/{id} into the
+      Verifier-only group and makes it return an offline article to a verified caller instead of
+      404, mirroring the listing endpoint's visibility rule; the two scenarios below that depended
+      on the older, stricter rule are updated accordingly
 
   Scenario Outline: The article repository reports a missing article as a domain error
     Given a repository backed by an in-memory SQLite database containing an article titled "Backyard Renovation Update" with id 1
@@ -42,10 +46,10 @@ Feature: Domain not-found errors instead of raw GORM errors
     Then the response status is 404
     And the response body is the text "Article not found"
 
-  Scenario: Fetching an offline article still answers 404 with the same message
-    Given a valid jwt cookie for a user with id 1
+  Scenario: Fetching an offline article as an anonymous or unverified caller still answers 404 with the same message
+    Given no jwt cookie is sent
     And the article repository contains an article with id 2, is_online false
-    When the client sends GET /v1/article/2 with that cookie
+    When the client sends GET /v1/article/2 without a cookie
     Then the response status is 404
     And the response body is the text "Article not found"
 
@@ -56,11 +60,12 @@ Feature: Domain not-found errors instead of raw GORM errors
     Then the response status is 200
     And the response body is the article's JSON representation
 
-  Scenario: The article route still requires authentication before existence is even checked
+  Scenario: An unknown article id answers 404 even without authentication
     Given no jwt cookie is sent
     And the article repository has no article with id 9999
     When the client sends GET /v1/article/9999 without a cookie
-    Then the response status is 401
+    Then the response status is 404
+    And the response body is the text "Article not found"
 
   Scenario Outline: Login never reveals whether the username exists
     Given a user repository containing a user "alice" with password "hunter2example"