fix: let sharing links into a CMS-mode community

[isTravis]

CMS mode was admitting members only (as designed), so a Sharing/View URL like /pub/<slug>/draft?access=<hash> returned "We can't find that community" to the very people it is for. Authors could not reach their own proofs without first being added as members of the community, which puts an account-provisioning step in front of every review.

The cause was ordering, not policy: the gate ran before getScope, which is the only place an ?access= hash is resolved, so the hash was never consulted. The community 404'd first. That also explains why changing the discussion permissions had no effect -- this is a community-existence gate, not a permission one.

So the CMS gate now runs after getScope and keys on activePermissions.canView, which is precisely "insider": a member of the community, collection or pub, a superadmin, or the holder of an access hash matching something in this URL. Public permissions do not raise it, and neither does a pub being released (a released pub is visible via releases.length, a separate path), so the community stays invisible to the public.

The spam gate keeps its old position and its members-only rule. A spam-flagged community has no way to opt a visitor back in, so it needs nothing from the scope; only CMS mode does.

Two consequences worth noting:

• Requests that are turned away now run getScope before 404ing. It already ran for every request that got through.
• On a custom-domain community the domain redirect now precedes the gate, so a subdomain request redirects and is gated at the destination.

The banner in App.tsx keyed on merely being logged in, which would now show "only Members can see this page" to an author who arrived by link; it keys on community membership instead.

Tests: isCmsGated covers the gate decision. A DB-backed scopeGet test pins the load-bearing assumption -- that canView is false for anonymous and logged-in non-member visitors to a released pub carrying the most permissive public permissions, false for a wrong hash and for another pub's hash, and true for a member and for view/comment hash holders.