perf(cms): eliminate redundant DB queries on public CMS read path

[jameswillis99]

Every published CMS table read was executing up to 9 DB queries per request due to duplicate table lookups and permission checks across getCmsTableByIdentifier and queryCmsRows/countCmsRows.

Consolidates to 4 queries (cms_database + workspace + cms_table + cms_row) by:

• Adding an accessLevel parameter to getCmsTableByIdentifier so the draft vs published permission check happens once upfront at the right level, rather than being repeated inside the row query functions.
• Extracting queryCmsRowsForTable and countCmsRowsForTable which accept a pre-loaded CmsTable and skip the redundant lookup and perm check.
• Updating queryTable and countTable in the public read router to use the ForTable variants after getCmsTableByIdentifier.
• Removing the countCmsRows wrapper (no production callers remain) and updating the spec to call countCmsRowsForTable directly.

queryCmsRows (by tableId) is preserved unchanged for cmse.ts and CmsRowCache which only have a tableId at call time.