Public Desk Book

A desk's published book, newest first.

404s for an unknown desk rather than returning an empty book, so a consumer can tell "this desk has published nothing yet" apart from "this desk does not exist" — the two need different copy on the page.

Uses session_scope() rather than Depends(get_db): this handler makes three round-trips, and a request-scoped session held across all of them is the pool-exhaustion pattern the static audit exists to catch. The prod pool is 5 + 3 overflow, so a public endpoint holding a connection longer than it needs is a real outage risk, not a style point.