fix: enforce private feedback access across list and detail

tests/worker-organization.test.js

@@ -198,6 +198,7 @@ test('feedback update keeps verified owner headers and cannot overwrite organiza
     assert.ok(!String(url).includes('org-context'));
     assert.equal(init.headers['x-requester-id'], USER);
     assert.equal(init.headers['x-requester-tenant-id'], ROOT);
+    if (init.method === 'GET') return json({ id: FEEDBACK, requester_id: USER, is_secret: false });
     const body = JSON.parse(init.body);
     assert.equal(body.requester_id, undefined);
     assert.equal(body.requester_affiliation, undefined);
@@ -219,6 +220,7 @@ for (const method of ['GET', 'PATCH', 'DELETE']) {
       assert.ok(!String(url).includes('org-context'));
       assert.equal(init.headers['x-requester-id'], USER);
       assert.equal(init.headers['x-requester-tenant-id'], ROOT);
+      if (method !== 'GET' && init.method === 'GET') return json({ id: FEEDBACK, requester_id: USER, is_secret: false });
       assert.equal(init.method, method);
       return json({ message: 'Forbidden resource' }, 403);
     }, async () => {