fix: reading a single article follows the same rule as the list: anyone can read an online article, a verified user can also read an offline one, and an unknown or hidden id returns 404

features/public_article_listing.feature

@@ -14,8 +14,11 @@ Feature: Public and authenticated article listing
       in api/router.go along with GET /v1/article/{id}, POST /v1/article/ and DELETE /v1/article/{id},
       so an anonymous request to any of them answers 401, not an online-only list
     And this slice moves GET /v1/article/ under jwtauth.Verifier only, so a missing or invalid jwt
-      cookie no longer blocks the request; GET /v1/article/{id}, POST /v1/article/ and
-      DELETE /v1/article/{id} keep requiring jwtauth.Verifier + Authenticator, unchanged
+      cookie no longer blocks the request; POST /v1/article/ and DELETE /v1/article/{id} keep
+      requiring jwtauth.Verifier + Authenticator, unchanged
+    And a later slice, features/public_article_read.feature, moves GET /v1/article/{id} into the
+      same Verifier-only group as GET /v1/article/, so the 401 Examples table below is updated
+      accordingly
     And Handler.ListArticles decides between ListAllArticles and ListOnlineArticles by checking the
       request for a valid jwt, read with jwtauth.FromContext from the token the router-level
       jwtauth.Verifier (header and cookie sources) placed in the request context, rather than
@@ -53,7 +56,6 @@ Feature: Public and authenticated article listing
 
     Examples:
       | method | path                |
-      | GET    | /v1/article/1       |
       | POST   | /v1/article/        |
       | DELETE | /v1/article/1       |