fix: enforce private feedback access across list and detail

tests/page-search.test.js

@@ -100,6 +100,22 @@ test('one and two character queries require a literal match to limit unrelated r
   assert.deepEqual(ids(page.search(posts, '오류')), []);
 });
 
+test('list hides another author private title and cannot search their hidden title or contents', async () => {
+  const page = pageContext(async () => ({ items: [
+    record('private-other', '숨긴제목', { is_secret: true, requester_id: 'other', contents: '숨긴본문' }),
+    record('private-own', '본인비밀글', { is_secret: true }),
+    record('public', '공개글')
+  ] }));
+  await page.init();
+  assert.match(page.html(), /비밀글입니다\./);
+  assert.match(page.html(), /본인비밀글/);
+  assert.doesNotMatch(page.html(), /숨긴제목|숨긴본문|detail.html\?id=private-other/);
+  page.submit('숨긴제목');
+  assert.equal(page.elements.get('#resultCount').textContent, '총 0건');
+  page.submit('숨긴본문');
+  assert.equal(page.elements.get('#resultCount').textContent, '총 0건');
+});
+
 test('all remote pages are loaded and duplicate IDs do not duplicate search results', async () => {
   const first = Array.from({ length: 100 }, (_, index) => record(String(index + 1), '일반 문의 ' + index));
   const page = pageContext(async (number) => ({ items: number === 1 ? first : [first[99], record('older', '로그인 오류')], meta: { total: 101 } }));