Fix post IDOR reads, update_post 404, invalid-UUID 400, and field validation - #2

Summary

Fixes the 5 confirmed post-router defects flagged by the QA suite. Stacked on the test-suite branch (PR #1) so the diff is just the fixes plus flipping the corresponding xfail/placeholder tests into normal passing assertions. After this: 39 passed, 1 skipped (the skip is the still-unimplemented login rate limiter).

Highest priority (data confidentiality / IDOR):

1. GET /api/posts/{id} now scopes to the caller — returns 403 when the post belongs to another user.
2. GET /api/posts/ now filters by the authenticated user instead of returning every user's posts.

Also fixed:
3. update_post returns 404 (was 200) when the post doesn't exist.
4. GET/PUT/DELETE /api/posts/{id} validate the path param and return 400 for a malformed UUID (was an uncaught DB DataError → 500).
5. POST /api/posts/ rejects empty title/content via constr(min_length=1).

Key changes:

# post.py
def parse_post_id(id: str) -> uuid.UUID:
    try: return uuid.UUID(id)
    except ValueError: raise HTTPException(400, f'Invalid post id: {id}')

get_posts:  ...filter(Post.user_id == user_id, Post.title.contains(search))   # was un-scoped
get_post:   post_id = parse_post_id(id); ...; if str(post.user_id) != user_id: raise HTTPException(403, ...)
update_post: raise HTTPException(404, ...)   # was status_code=200
delete_post: post_id = parse_post_id(id)

# schemas.py
class PostBaseSchema(BaseModel):
    title:   constr(min_length=1)   # was str
    content: constr(min_length=1)   # was str

Not addressed here (still open from the QA report): login rate limiting (needs a limiter — the placeholder test stays skip), committed .env secrets, outdated/CVE dependencies, insecure cookies/email TLS.

Link to Devin session: https://app.devin.ai/sessions/00a96a01db324b9583129cd1fd0e9ac4
Requested by: @tejasri757