Function assert_can_read_logo 

pub async fn assert_can_read_logo(
    db: &SqlitePool,
    current_user: Uuid,
    logo_id: Uuid,
) -> Result<LogoRow, Error>

Permission gate for reading a logo. Personal: must be the owner. Group: must be a member of the owning group.

Errors

Returns Error::NotFound when the row is missing or invisible — the two cases are collapsed so an attacker cannot confirm existence by id.