LCFS - Enforce visibility and role based access control on the Comment Log server-side

**Description:**
Add server-side authorization and visibility filtering for all Comment Log reads. `Internal` comments must never be returned to BCeID users; hiding them on the client is not acceptable.

Rules:
- IDIR/government users → `Internal` and `external` comments, subject to existing org-access patterns.
- BCeID users → only `external` comments, only for their own organization.

Relevant files:
- `backend/lcfs/web/api/internal_comment/views.py`
- `backend/lcfs/web/api/internal_comment/services.py`

**Wireframe:** https://preview.uxpin.com/7264e34749e7af420559b8cfc0ca8001c76db3ec#/pages/223328163/simulate/no-panels

**Purpose and benefit to user:**
Protects internal government commentary from being exposed to suppliers and meets compliance and privacy expectations.

**Acceptance Criteria:**
- [ ] Given I am a BCeID user, When I query my organization's Comment Log, Then no `Internal` comments appear in the response payload under any filter combination.
- [ ] Given I am a BCeID user, When I query another organization's Comment Log, Then I receive a `403`.
- [ ] Given I am an unauthenticated caller, When I call the endpoint, Then I receive a `401`.
- [ ] Given I am an IDIR user with appropriate role, When I query any organization, Then I receive both visibility levels.

**Development Checklist:**
- [ ] Add BCeID organization-ownership check in the route handler
- [ ] Force `visibility = 'external'` in the repository query for BCeID callers
- [ ] Audit existing `internal_comment` read endpoints for the same gap
- [ ] Role-matrix tests (IDIR analyst, IDIR manager, BCeID supplier, BCeID manager)
- [ ] Confirm no `Internal` text appears in any BCeID response

**Notes:**
- Cross-organization visibility for IDIR users is out of scope for Phase 1 and tracked separately.