🔒️ Blocks hold on the website too; reports only reach what the reporter can see

- The web comment form and "ask for this item" now honour blocks, and the rule lives in the model (Donation#open_to?, a Comment validation), so any future path is covered as well. - The web comment controller hides drafts like the donation page does. - Reports of a draft listing, or of a comment on one, 404 for anyone but the owner, so they can't be used to find out that a draft exists.