Function assert_can_read_theme 

pub async fn assert_can_read_theme(
    db: &SqlitePool,
    current_user: Uuid,
    theme_id: Uuid,
) -> Result<ThemeRow, Error>

Permission gate for reading a theme. Personal: must be the owner. Group: must be a member of the owning group.

Errors

Returns Error::NotFound when the row is missing or invisible — the two cases are collapsed so an attacker cannot confirm existence by id.