Hydration endpoint for the lazy dashboard shell.

The page render at GET /dashboards/<id> paints the layout in tens of ms by skipping per-block output reads. Each displayed block lands as a pending iframe carrying its data-block-id. On load, the page fetches this endpoint once and patches every pending cell via the same applyCascadeViews path the cascade endpoint uses. The shape mirrors build_block_views_for_render exactly so the FE has one branch, not two.

Auth mirrors the dashboard page route: owner / link_view / explicit grant. A caller without access gets a 404 (same shape as the page route — never leak existence).