A status asked for by id is shown, and remote warnings are their own

GET /api/v1/statuses/:id applied the viewer's own blocks and mutes and
answered 200 with null for a post of an author the viewer had blocked;
decePub's thread page then showed nothing. As in Mastodon, a status asked
for by id (or acted on) is shown whatever the viewer blocked or muted,
and only lists leave such posts out; when nothing can be shown the
answer is 404, never null, and search leaves it out.

A remote post marked sensitive with an empty summary (Akkoma's sensitive
media, Lemmy's NSFW) got an invented "Content warning" that hid its
words. A remote post now keeps its own summary: sensitive without one
hides the media only. A local post warned without words still gets the
default warning.

Both found by decePub's end-to-end tests on the town.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

PrivaPub.Tests/Http/MastodonStatusesTests.cs

@@ -130,6 +130,39 @@ namespace PrivaPub.Tests.Http
 			Assert.Equal(1, (await alice.Client.Get($"/api/v1/statuses/{parent.ID}")).Ok().Body.Number("replies_count"));
 		}
 
+		// Akkoma marks a post with sensitive media "sensitive" and leaves its summary empty: the media is hidden, the words are
+		// not, and no warning is made up for them (found by decePub's e2e tests on the town)
+		[Fact]
+		public async Task A_remote_post_sensitive_without_a_summary_hides_its_media_and_not_its_words()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			_peer.WebFinger(bob);
+			var post = await _host.PublicPostFrom(bob, alice, shape: note => { note["sensitive"] = true; note["summary"] = ""; });
+
+			var status = (await alice.Client.Get($"/api/v1/statuses/{post.ID}")).Ok().Body;
+
+			Assert.True(status["sensitive"]!.GetValue<bool>());
+			Assert.Equal("", status.Text("spoiler_text"));
+		}
+
+		// a status asked for by id is shown even when the viewer blocked or muted its author, as Mastodon shows it: only lists
+		// leave such posts out (it once answered 200 with null, and decePub's thread page showed nothing)
+		[Fact]
+		public async Task A_status_of_an_author_the_viewer_blocked_is_still_shown_by_its_id()
+		{
+			var alice = await _host.Mastodon("alice");
+			var bob = new RemoteActor(_peer, "bob");
+			_peer.WebFinger(bob);
+			var post = await _host.PublicPostFrom(bob, alice);
+			var bobId = (await _host.Known(bob)).ID;
+			(await alice.Client.Post($"/api/v1/accounts/{bobId}/block")).Ok();
+
+			var status = (await alice.Client.Get($"/api/v1/statuses/{post.ID}")).Ok().Body;
+
+			Assert.Equal(post.ID, status.Text("id"));
+		}
+
 		[Fact]
 		public async Task A_poll_is_created_validated_and_federated_as_a_question()
 		{