fix(backend) defects in registration form backend

[sabinem]

1. Signup deadlocked. Join validates the mandatory answers, answering needs the questions, and ListQuestions required hackathon:read — which a non-member does not hold, since AllowPublicHackathonAccess is defined in rbac.go but never called. So a hackathon asking anything mandatory could not be joined by anyone. ListQuestions now serves a public hackathon to any caller, the same rule List already applies to the hackathons themselves; a private event still requires the grant. It also returns NotFound for an unknown id instead of an empty list.

2. ListParticipantAnswers leaked. hasWrite was computed but only consulted on the "no user_id" path, so naming any user id skipped the check entirely and returned what that person wrote about themselves. Reading someone else's answers is now organizer-only; reading your own still is not.

3. Bool answers could not round-trip. answerEntryFromEnt always emitted text_value, so a BOOL question read back as text_value "true" — and SubmitAnswers refuses a text answer to a bool question. Loading a form and saving it unchanged therefore failed validation on every bool question, which is what an edit form does on every save. The oneof arm now follows the question's type, which the query eager-loads.

One existing test changed meaning: ListQuestions requires Read permission asserted the pre-fix behaviour, so it is retargeted at a private hackathon and renamed accordingly. That is the only intentional behaviour change.