Tut: Fix permissions for developer views

Developers can now view other developers when they know the slug or id. Even when the profile shouldn't be public.

Reproduce it in a test and fix it.

Start by reproducing the reported access using a developer profile whose public visibility is disabled, then locate the Django code handling developer views and permissions. Add a regression test covering lookup by slug or ID, and verify that non-public profiles cannot be viewed while permitted access still works.

索引モデルが issue の本文から書いたものです。