Composer: public/private visibility toggle (`publiclyVisible`)

[Adron]

Part of #17 — Message composer & feed parity gaps

Every message on the web is Public (visible to anyone on the feed and the author's
profile) or Private (visible only to the author), with a toggle in the composer and a default
taken from Settings → Message Settings.

Android never sends publiclyVisible, so the server default silently decides — the user has no
control and no indication of what they posted.

• Add the toggle to the composer and send publiclyVisible.
• Default it from the account's defaultPubliclyVisible preference (see the Settings epic), with
  a per-message override.
• Show the resulting visibility on the message card, so a private post is unmistakable.
• Push and Quote posts are always public — force and explain it there.

Tests: request carries the flag; default comes from preferences; override wins.

---

Filed from the parity review of feature/parity-wip @ 14d7795 against interlinedlist.com (OpenAPI /api/openapi.json, 233 paths) and the public help centre.

[Adron]

Implemented in #91 (branch issue/18-composer-visibility). Closing here — review and any follow-up happens on the PR.

Carried forward: the composer reads defaultPubliclyVisible fresh from GET /api/user rather than from a persisted store, so an offline compose opens on public. Persisting it belongs with #31/#32, which own the write side of that preference. The push/quote-always-public rule is expressed as MessageVisibility.PUSH_OR_QUOTE for #20 to consume.