Get a single brief by ID. Access rules:

• Admins can fetch any brief (used by the admin dashboard's per-brief link).
• The brief's owner (briefs.user_id == caller.id) can fetch their own.
• Members of a paid team can fetch briefs scoped to that team (briefs.team_id == caller.team_id, both non-null).
• Everyone else — including unauthenticated callers and other signed-in users who aren't on the brief's team — gets 404. We deliberately don't distinguish "not found" from "you can't see it" so brief IDs don't leak existence to people who shouldn't see them.

Tier-locked fields (pricing, risk_output, langsmith_run_id) are still stripped per the caller's access tier inside _filter_brief_for_access.