[verified] Apply independent-reviewer suggestions: mask sales_kit/report to trainees, ready-gate get_persona

Responding to the requesting-code-review independent reviewer (passed:true, zero blocking issues):
- get_group: hide sales_kit + report from trainees (they contain latent pain analysis)
- get_persona: add status==ready gate for trainees (parity with list_personas)
- Extend test_security.py with latent-leak + non-ready-gate assertions; all suites pass

backend/app/api/group_routes.py

@@ -195,10 +195,11 @@ def get_group(gid: str):
 
     view = dict(group)
     if actor.get("role") == "user":
-        # Trainee: hide latent persona fields + sales kit details they shouldn't see
-        view["personas"] = [
-            revealable_view(p) for p in group.get("personas", [])
-        ]
+        # Trainee: hide latent persona fields + sales kit + report (they contain
+        # pain analysis / latent data a real seller wouldn't know before a result).
+        view["personas"] = [revealable_view(p) for p in group.get("personas", [])]
+        view["sales_kit"] = None
+        view["report"] = None
     return jsonify({"group": view})
 
 
@@ -234,6 +235,9 @@ def get_persona(gid: str, pid: str):
     if not p:
         raise ApiError("persona not found", 404)
     actor = current_user()
+    # Trainees may only view personas from ready groups (parity with list_personas).
+    if actor.get("role") == "user" and group.get("status") != "ready":
+        raise ApiError("group not ready", 403)
     ensure = ensure_persona_shape(p)
     if actor.get("role") == "user":
         return jsonify({"persona": revealable_view(ensure)})