fix: retrieve published posts by numeric ID

[conorbronsdon]

What & why

Closes #125. get_post sent numeric IDs from list_published_posts to /api/v1/posts/:slug, which returned 404. It now calls /api/v1/posts/by-id/:id, unwraps post, checks the returned ID, and maps upstream wordcount to the existing word_count field. Public schemas and publication-selection rules are unchanged.

How verified

• npm run lint and npm run build pass.
• npm test: 1,001 passed, 1 skipped across 33 files.
• 14 regression cases cover route selection, unwrapping, zero word count, absent/wrong-ID responses, HTTP errors without retries, and real MCP text/structured output with one or multiple publications. Nine fail on the original implementation.
• Live public reproduction: the old numeric URL returned 404; the new route returned the reported article. Both the built client and complete MCP tool retrieved ID 216288861, body HTML and word count 1860. Text and structured results matched. Dummy credential only; no account access or writes. Authenticated/paywalled content and the reporter's installation were not tested.

Independent review

Reviewed commit: 0fadc15cfe1dd751657018a5fed31754401c46a9.

• Authenticated Claude claude-sonnet-5: no blocking findings.
• Hermes/OpenRouter thinkingmachines/inkling:free and nvidia/nemotron-3.5-lightning:free: completed independent public-code reviews, with tools and private context disabled; live prompt/completion prices verified zero. No verified blocking findings after triage.
• Rejected the suggestion to default an absent word count to zero: the existing MCP schema permits absence, and zero would invent data. The pre-existing TypeScript interface is stricter than the runtime contract. Other minor observations concerned the test BOM/header assertion and changelog wording; validation covers a missing post or mismatched ID, not every upstream field.
• Initial OpenCode Muse/Nemotron attempts returned provider HTTP 403 and were not counted. The two Hermes reviews completed as replacements. All findings were checked against actual files and test output.

Safe-by-design checklist

• No new publish / delete / schedule capability for long-form posts.
• Notes' existing immediate-publication behavior and descriptions unchanged.