Return a single backtest by run_id (user-scoped; 404 if not owned).

Auth: same effective-user resolution as POST /v1/backtests (require_backtest_submitter — session cookie wins when present, else X-Vega-Key). Without this, a session-submitted run (owned by the real user_id) would 404 when polled with only the shared demo key header — the poll must be able to see what the matching submit created. Ownership scoping is unaffected: db.get_backtest still filters on the resolved uid, so a different user's session (or a different key) still gets 404 on someone else's run.