feat: add get_post / sideshow show for single-post reads

[benvinegar]

What

This PR also includes the full per-surface operations feature (#165), since it was branched from #165 and merged first. #165 was closed as redundant.

Per-surface operations (from #165)

Surfaces now carry stable server-assigned ids, enabling targeted operations on individual surfaces within a post — across all three integration tiers.

CLI:

• sideshow publish honors flag order (surfaces appear in the order their --md / --code / etc. flags appear on the command line, not a fixed sequence). Fixes CLI publish: surface order is fixed by flag identity, not command-line flag order #158.
• sideshow update <id> <file|-> --surface N targets a specific surface in a multi-surface post.
• New sideshow surface subcommand: add, remove, edit, move.

HTTP API:

• POST /api/posts/:id/surfaces — append a surface (optional before/after).
• PATCH /api/posts/:id/surfaces/:target — replace or content-edit one surface.
• DELETE /api/posts/:id/surfaces/:target — remove one surface (400 if last).
• PATCH /api/posts/:id/surfaces — reorder surfaces.
• PATCH /api/posts/:id extended with optional surface param.

MCP: New tools add_surface, edit_surface, remove_surface, reorder_surfaces (both stdio and HTTP).

Data model: Every surface carries an optional id: string, assigned server-side. Existing data migrated automatically.

Viewer: Surfaces keyed by stable id (Solid <For>) instead of array position.

get_post / sideshow show (this PR)

Adds a read primitive for fetching a single post by id — the missing counterpart to list_posts / sideshow list.

MCP: get_post(id) — returns the full post object (surfaces with ids, version, history). Both stdio and HTTP transports.

CLI: sideshow show <id> — prints the full post JSON.

Why

Per-surface operations need surface ids to target a specific surface. After a context compaction, the agent loses the surface ids from an earlier publish but still has the post id. get_post gives agents a direct, cheap way to recover them without listing the entire session.

Read parity after this PR

Need	HTTP API	MCP	CLI
List posts in session	GET /api/sessions/:id/posts	list_posts	sideshow list
Get one post	GET /api/posts/:id	get_post	sideshow show <id>

Validation

npm test          → 379 pass, 0 fail
npm run typecheck → 3 programs clean
npm run lint      → 0 warnings, 0 errors
npm run format:check → clean