Message disclosure via missing history check

Authorization bypass in Stoat before 0.15.0 allows remote authenticated users to read message content via single-message fetch requests. In the delta backend's message_fetch route, the handler checks only ViewChannel before returning a message by ID, while sibling history routes require ReadMessageHistory and the underlying Reference::as_message fetch adds no further authorization. Exposure requires a channel configuration that grants ViewChannel but denies ReadMessageHistory; default settings grant both together, but affected members can still use reachable IDs such as last_message_id or reply references to read older content.