5ebe1f1a5a
Defense in depth: until now both list and single-person reads only required authentication, while the write endpoints (POST/PUT/DELETE) were already gated with @RequirePermission. The hover-card and typeahead introduced in issue #362 expose person details (life dates, notes, family relationships) to anyone who can authenticate — adding READ_ALL aligns the GETs with the write endpoints and matches the access tier already enforced for documents and transcription blocks. Two new controller-slice tests assert 403 when an authenticated user lacks READ_ALL; existing 200-path tests now stipulate `authorities = "READ_ALL"` explicitly. Refs #362 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>