Function assert_can_read_notecard 

pub async fn assert_can_read_notecard(
    db: &SqlitePool,
    current_user: Uuid,
    notecard_id: Uuid,
) -> Result<NotecardRow, Error>

Permission gate for reading a notecard. Personal: must be the owner. Group: must be a member.

Errors

Returns Error::NotFound if the notecard does not exist or is not visible to the caller — the two cases are collapsed so an attacker holding a guessed id cannot confirm existence.