feat(blog): add Visibility { Private, Public } to gate post reads

Replace the implicit 'ACL empty = private' convention with an
explicit two-axis model: Visibility is the master switch, the
ACL is the exception list.

Semantics (matches what BlogSpotService.Index / Details enforce):

  Visibility.Public  + empty ACL  : every caller sees it
  Visibility.Public  + non-empty  : only author + ACL circles + admin
  Visibility.Private + any ACL    : only author + admin (ACL ignored)
                                    ACL is preserved across
                                    Private/Public flips so
                                    reopening is lossless

The Public+non-empty shape is the 'restrict by exception' case:
open by default, narrowed by the ACL. This is intentionally
different from the previous behaviour, where a Public post
with a non-empty ACL was effectively ACL-restricted anyway —
the new model makes that explicit and removes ambiguity.

Server (Yavsc.Blogs / Yavsc.Server)
- New enum Visibility { Private, Public } in
  Yavsc.Abstract.Blogspot (so the wire DTO and the EF entity
  share the same type). Stored as int via .HasConversion<int>()
  on BlogPost.Visibility. Default Private on construction;
  the column default in the migration is 0 so existing rows
  land Private without any data migration.
- BlogSpotService.Index: filter rewritten to honour the two-
  axis model. Authenticated and anonymous callers now share
  the same shape (Public+emptyACL visible to all, otherwise
  scoped). Admin reads still go through PermissionHandler.
- PermissionHandler.IsPublic: dropped the blogSpotPublications
  lookup, replaced with the Visibility + empty-ACL check that
  matches the new model. PermissionHandler.IsSponsor and
  IsOwner unchanged.
- UserHelpers.UserPosts (the per-author feed for
  /CircleMembers/Details and similar): mirror of the
  Index filter, so the two code paths can't silently diverge.
- BlogPostEditViewModel.Publish untouched on this commit. It
  still controls whether a row exists in BlogSpotPublication;
  the two systems coexist (Publish = 'is this draft published',
  Visibility = 'who can read it'). Follow-up to consolidate.

EF migration (Yavsc.Org/Migrations/20260818143013_AddBlogPostVisibility)
- Scaffolded by 'dotnet ef migrations add', not hand-edited,
  per the repo preference for generated migrations.
- Adds the new Visibility column (int, NOT NULL, default 0).
- Also drops three shadow-state ClientId1 foreign keys and
  their indexes/columns on ClientScopes, ClientRedirectUris,
  ClientGrantTypes. These shadow FKs were created by EF from
  HasOne<Client>().HasForeignKey(e => e.ClientId) mappings
  that have long since been removed from
  ApplicationDbContext.OnModelCreating, but the snapshot was
  never regenerated against the current model. The columns
  are nullable ints with no production data, so the drop is
  lossless. Without this, EF Core would keep emitting
  warnings on every migration add and the model would drift
  further from reality.

DTO wire (Yavsc.Abstract.Blogspot.BlogPost)
- Visibility property added to BlogPostDto. System.Text.Json
  serialises the enum as its underlying int, so the JSON
  shape is a plain number, no JsonConverter needed.

Client UI (PostIt)
- MainPageViewModel: DraftVisibility ObservableProperty
  mirroring the existing DraftTitle/DraftArticle pattern.
  Initialised to Private so a fresh draft is private by
  default. Save command writes the chosen value into the
  BlogPostDto payload for both CreatePostAsync and
  UpdatePostAsync. OnSelectedPostChanged hydrates the buffer
  from the server-supplied value.
- AllVisibilities property on the VM exposes [Private, Public]
  in that order, bound by the ComboBox in MainPage.axaml.
- VisibilityLabelConverter (PostIt.Views) maps the enum to
  French user-facing labels ('Privé' / 'Public'); registered
  in App.axaml as a static resource.
- MainPage.axaml: a new ComboBox row in the editor pane
  between Title and Article. Uses the existing 'no hardcoded
  Background without Foreground' lesson so dark mode works.

Tests (Yavsc.Blogs.Tests)
- BlogVisibilityTests (5 [Fact]): drive GET /api/v1/blog with
  Visibility fixtures seeded directly in the in-memory DB:
    * Private + ACL: only the author sees it
    * Public + empty ACL: any authenticated caller sees it
    * Public + non-empty ACL: caller without ACL membership
      does NOT see it
    * Private + ACL: ACL is ignored, only the author sees it
    * Visibility round-trips through the JSON wire (int 1)
- UserHelpersVisibilityTests (4 [Fact]): exercise the helper
  directly so the two code paths (Index filter vs per-author
  feed) can't diverge silently. Same fixture, no HTTP.

Test totals: 29/29 Yavsc.Blogs.Tests (was 20, +5 BlogVisibility
+4 UserHelpersVisibility), 51/51 PostIt.Tests (no change), 44/44
Yavsc.Org.Tests (no change).

Out of scope (tracked in MEMORY.md, 2026-08-18):
- i18n: only the new 'Visibilité :' label is localised; the
  rest of MainPage.axaml is still hard-coded French.
- BlogPostEditViewModel.Publish ↔ Visibility consolidation
  (which system wins when both are set on the same post?).
- Org-side UI for editing Visibility (the admin web Yavsc
  still edits posts without a visibility field).

src/Yavsc.Abstract/Blogspot/BlogPost.cs

@@ -19,6 +19,18 @@ public class BlogPostDto : IBlogPost
     public string UserModified { get; set; }
     public string Title { get; set; }
 
+    /// <summary>
+    /// Visibility of this post. Mirrors the EF entity
+    /// <c>Yavsc.Models.Blog.BlogPost.Visibility</c>: serialised
+    /// as an <c>int</c> by <c>System.Text.Json</c> (the enum's
+    /// underlying type), so clients see <c>0</c> or <c>1</c>
+    /// rather than <c>"Private"</c>/<c>"Public"</c>. Defaults
+    /// to <see cref="Visibility.Private"/> on construction, so
+    /// existing client code that doesn't set it explicitly
+    /// stays safe (private-by-default).
+    /// </summary>
+    public Visibility Visibility { get; set; } = Visibility.Private;
+
     public bool AuthorizeCircle(long circleId)
     {
         throw new NotImplementedException();

src/Yavsc.Abstract/Blogspot/Visibility.cs

@@ -0,0 +1,41 @@
+namespace Yavsc.Blogspot;
+
+/// <summary>
+/// Post visibility.
+///
+/// <list type="bullet">
+///   <item><description>
+///     <see cref="Public"/>: the post is read via its ACL. If the
+///     ACL is empty, every caller sees the post (including
+///     unauthenticated ones, on endpoints that allow it). If the
+///     ACL is non-empty, only the author, the members of the
+///     circles in the ACL, and administrators can read. Public +
+///     non-empty ACL is therefore the "restrict by exception"
+///     shape: open by default, narrowed by the ACL.
+///   </description></item>
+///   <item><description>
+///     <see cref="Private"/>: the ACL is ignored at read time.
+///     Only the author and administrators can read. The ACL list
+///     is preserved in the database so that flipping the post
+///     back to <see cref="Public"/> restores the previous
+///     restriction without re-entry.
+///   </description></item>
+/// </list>
+///
+/// <para>The two values together form a two-axis model: the ACL
+/// is the exception list (it can narrow Public), and Visibility
+/// is the master switch (it can disable the ACL entirely when
+/// set to Private).</para>
+///
+/// <para>Stored as <c>int</c> (not the enum name) — see the
+/// <c>.HasConversion&lt;int&gt;()</c> on <c>BlogPost.Visibility</c>
+/// in <c>Yavsc.Server.Models.ApplicationDbContext</c>. Keeping the
+/// int mapping means queries stay cheap and the wire JSON is a
+/// plain number; the trade-off is that reading the column by hand
+/// requires knowing the enum ordering.</para>
+/// </summary>
+public enum Visibility
+{
+    Private = 0,
+    Public = 1,
+}