Withhold owner feedback from share-link viewers

[bdart]

Follow-up to #878 (ERMAIN-486). After 486 removes the share-link Chat::Read grant, a viewer can no longer write feedback — but the dedicated share-link route still embedded the owner's feedback in its response, because it reuses assemble_chat_messages_response, which fetched feedback unconditionally. That read-exposure is independent of the rego change and is what this PR closes.

Change

• Thread include_feedback through assemble_chat_messages_response: the owner route passes true, the share-link route passes false. A share-link viewer never receives the owner's 👍/👎 or free-text comment.
• Integration test (extends test_chat_share_link_enable_disable_flow):
  • owner leaves feedback and sees it on their own view — positive control, so the assertion below is not vacuous;
  • the share-link view returns feedback: null for that message;
  • the viewer's PUT /messages/{id}/feedback is denied (403) — the write-denial that 486 enables;
  • the viewer's DELETE /messages/{id}/feedback is denied (403) — retraction (ERMAIN-488 / Allow users to retract message feedback #865, now on base) gates on Chat::Read too.

The read-scope fix here is independent of 486 and could land on its own, but it's kept in the stack to land together.

Stacks on #878; part of the 485 → 486 → 489 set meant to land together.

Closes ERMAIN-489.

Validated locally: the extended integration test is green against Postgres.