Private subtrees respect their read policy

A public page can contain a private subtree. Its read restriction now applies when someone opens a child directly, matching the existing policy precedence used by PostgreSQL listings.

Ordinary public content stays readable. A public grant placed at the same scope as a read cap retains its existing precedence; a deeper read cap restricts inherited public access.