Add authorization policy hooks (canView/canComment/canReact)

[felixbeer]

Problem

Access checks are currently entitlement-centric, but not explicitly modeled as content behavior policies.

Scope

• Add policy hooks for authorization decisions only: canView, canComment, canReact.
• Keep this issue limited to access/authorization decisions.
• Do not implement full comment/reaction storage/UI in this issue.

Why

Most course/content systems need optional interaction permissions, but implementation details for comments/reactions vary by project.

Acceptance criteria

• Projects can define policy logic per content type/collection.
• Templates/controllers can query unified authorization hooks.
• Existing entitlement behavior remains default/fallback.