Delivery: an audience level between Public and staff, and delivery that accepts a viewer token

Public delivery has two audiences: anonymous, and nobody else. Every delivery route is `AllowAnonymous()` (`barakoCMS/Features/Public/Endpoints.cs:318`, `:462`, `:547`), every entry goes through `ToPublic` which keeps Public fields only (`Endpoints.cs:232`), and nothing under `barakoCMS/Features/Public` reads the caller's identity. The share cookie barakoPress sets after a redeem carries an expiry and an HMAC over the tenant, no viewer (barakoPress `src/site.ts:162`).

### Why it is too specific

Anything between a stranger and a staff member has no home. A club wants a members-only page, a school wants the teacher time clock on the public site, a clinic wants a patient to read their own appointment. Today each would need a staff console account or a custom endpoint, and #858's allowed viewer has nothing to check against.

### The general concept

An audience level between Public and staff on content types and fields (for example Members), and delivery that accepts an optional viewer token. With a token, delivery evaluates the same permission predicate compiler authoring uses, so a row condition like own record works on the public site too. Without one, delivery behaves exactly as today.

### Where it lives

Core: delivery, sensitivity and auth. barakoPress consumes it through its viewer sessions (barakoPress #7).

### Compatibility

Released surface. The new level is additive and the token is optional, so anonymous delivery and every existing response keep their shape. No stored data changes until a type opts in.

Part of the decision on what a principal is, linked from the umbrella issue. Relates #858, #857, barakoPress #7.

### Done when

- An entry of a Members type is refused to an anonymous delivery call and returned with a member's viewer token, with a test that fails before the change.
- A field marked Members is absent anonymously and present for a member.
- A viewer token grants no authoring route.

Found in the architecture sweep of 15 September 2026.

Start with barakoCMS/Features/Public/Endpoints.cs at lines 232, 318, 462, and 547, then trace the existing authoring permission predicate compiler and the share-token handling described in the issue. Define the additive audience and optional viewer-token behavior across delivery, sensitivity, and auth. Done means the listed anonymous/member entry and field cases pass, while the token cannot access authoring routes.

Written by the indexing model from the issue text.