security: hide draft posts from public detail endpoint

Add post.draft? check to GET /api/volumen/posts/:slug so guessing a
draft slug returns 404 like the list endpoint already does.

lib/volumen/api_routes.rb

@@ -19,7 +19,7 @@ module Volumen
 
       app.get "/api/volumen/posts/:slug" do
         post = store.find(params["slug"], lang: params["lang"])
-        halt(404, json("error" => "not_found")) if post.nil?
+        halt(404, json("error" => "not_found")) if post.nil? || post.draft?
 
         json(post.detail)
       end

test/server_test.rb

@@ -103,4 +103,10 @@ class ServerTest < Minitest::Test
     refute_includes body, "Draft"
     assert_includes body, "<language>en</language>"
   end
+
+  def test_draft_post_detail_is_not_found
+    get "/api/volumen/posts/draft"
+    assert_equal 404, last_response.status
+    assert_equal "not_found", JSON.parse(last_response.body)["error"]
+  end
 end