security: hide draft posts from public detail endpoint

Add post.draft? check to GET /api/volumen/posts/:slug so guessing a
draft slug returns 404 like the list endpoint already does.

test/server_test.rb

@@ -103,4 +103,10 @@ class ServerTest < Minitest::Test
     refute_includes body, "Draft"
     assert_includes body, "<language>en</language>"
   end
+
+  def test_draft_post_detail_is_not_found
+    get "/api/volumen/posts/draft"
+    assert_equal 404, last_response.status
+    assert_equal "not_found", JSON.parse(last_response.body)["error"]
+  end
 end