♻️(backend) remove different reach for authenticated and anonymous

If anonymous users have reader access on a parent, we were considering
that an edge use case was interesting: allowing an authenticated user
to still be editor on the child.

Although this use case could be interesting, we consider, as a first
approach, that the value it carries is not big enough to justify the
complexity for the user to understand this complex access right heritage.

src/backend/core/models.py

@@ -115,16 +115,16 @@ class LinkReachChoices(models.TextChoices):
         if LinkRoleChoices.EDITOR in reach_roles.get(cls.PUBLIC, set()):
             return {cls.PUBLIC: [LinkRoleChoices.EDITOR]}
 
-        # Rule 2: public/reader
-        if LinkRoleChoices.READER in reach_roles.get(cls.PUBLIC, set()):
-            result.get(cls.AUTHENTICATED, set()).discard(LinkRoleChoices.READER)
-            result.pop(cls.RESTRICTED, None)
-
-        # Rule 3: authenticated/editor
+        # Rule 2: authenticated/editor
         if LinkRoleChoices.EDITOR in reach_roles.get(cls.AUTHENTICATED, set()):
             result[cls.AUTHENTICATED].discard(LinkRoleChoices.READER)
             result.pop(cls.RESTRICTED, None)
 
+        # Rule 3: public/reader
+        if LinkRoleChoices.READER in reach_roles.get(cls.PUBLIC, set()):
+            result.pop(cls.AUTHENTICATED, None)
+            result.pop(cls.RESTRICTED, None)
+
         # Rule 4: authenticated/reader
         if LinkRoleChoices.READER in reach_roles.get(cls.AUTHENTICATED, set()):
             result.pop(cls.RESTRICTED, None)