db: posts: add indices

There is a tiny incremental improvement in performance for searches that
rely on `tenant_id` and the `published` boolean.
perf: update
allow '/posts' to be viewable in development mode

This is to help 'ab' do its job (I don't think ab has a way of logging
in, which is the old requirement of seeing if the user is an
administrator to be able to view the '/posts' route).