fix(backend): close D4 (anonymous vote results) and D5 (waitlisted submission read)

[caviri]

Two more backend authorization holes from the audit, same shape as D1/D2/D3.

D4 — anonymous could read vote results

ListVoteResults used RequireSubject, which admits the anonymous subject, so an unauthenticated caller could read placements the moment VIEW_RESULTS was open — even though the handler's own comment says "any signed-in user". Switched to RequireUser. The capability gate still lets organisers review a tally before publishing, and the only caller is the authenticated /my/hackathon/[id]/voting route, so nothing public breaks. (The VIEW_RESULTS-defaults-open half is left as-is: all six capabilities seed open by documented design — "a hackathon states its policy explicitly" — and the organiser can close it in the panel.)

D5 — waitlisted registrants read every team's submission

GetSubmission/ListSubmissions fall back to a hackathon-wide Submission:Read so participants can read every team's work to vote on it. But Join grants the Member role even to waitlisted registrants (so they can propose), and Member carries that hackathon-wide read — so an unapproved registrant could read all submissions. A composition nobody chose.

Fix: a shared authorizeSubmissionRead helper — team-scoped read unchanged; the hackathon-wide path now excludes callers holding a waitlisted participant row. Confirmed participants (no waiting row) and organizers/admins (who reach it via Owner/admin, not a participant row) are unaffected.

Tests (both pinned)

• submission_read_gate_test.go — a waitlisted joiner gets PermissionDenied reading another team's submission; approval lifts it to NotFound (past the gate) — a different code proves the gate opened.
• D4 relies on RequireUser, already covered by require_user_test.go.

Verification (devcontainer, fast tier)

• go build ./... clean · go test ./internal/service/... ./internal/middleware/... OK (D5's new spec passes) · gofmt -l empty