v0.2.7

slingshot-community 0.2.6 — contentTargetGuard reads the target from path params.

Fixes Reaction.listByTarget (GET /community/reactions/list-by-target/:targetId/:targetType), which always returned 400 Invalid JSON body: the guard parsed a request body unconditionally, and a GET has none. Reaction counts never loaded in a consumer app — every feed row rendered 0 regardless of real counts, and un-reacting was broken because the client resolves the DELETE row id from that same response.

The guard now prefers path params and falls back to the body, so POST call sites are unchanged. requireContainerIdMatch is skipped for param-addressed requests, since it exists to cross-check a client-asserted containerId and a param route asserts none.

Regression test fails 3/7 against the previous guard.