Figure out how single annotation pages / the stream are going to work for open and restricted groups

Timestamps on annotation cards link to a "single annotation page" at `/a/:id` which shows just the annotation on its own plus any replies. We haven't considered how this is going to work for annotations made in open and restricted groups.

There is also a thing called "the stream" at `/stream` which is less important and perhaps we can avoid worrying about that.

Begin with the `/a/:id` single-annotation page described in the issue, then consider how its replies and access should behave for open and restricted groups. Treat `/stream` as secondary, since the issue says it may be avoidable. Done means the behavior for both group types is agreed, including what a visitor can see and how the routes should work.

Written by the indexing model from the issue text.