Restrict `ShowUserController` by ID to users who can `viewUserList

## Bug Report

**Current Behavior**
`ShowUserController` currently only uses `viewDiscusions` (via `ScopeUserVisibility`) to restrict who can access user profiles (changed from `viewUserList` in flarum/framework#2305). This makes sense when accessing the profile by slug, but we should restrict it to `viewUserList` when accessing by ID to prevent enumeration.

**Environment**
- Flarum version: beta 15

**Possible Solution**
When not accessing by slug, a check for $user->can('viewUserList') should be done.

Start at ShowUserController and trace how ScopeUserVisibility handles profile lookup by slug versus ID. Verify the ID path checks viewUserList while slug access retains its existing restriction, then add or run focused coverage showing that users without this permission cannot enumerate profiles.

Written by the indexing model from the issue text.