Apply public-content-visibility: visibility flag + public profile

Implements the public-content-visibility OpenSpec change. Adds the
smallest social surface that lets us demo the product to logged-out
visitors without user signup.

Schema:
- `visibility text NOT NULL DEFAULT 'private'` on routes + activities.
- Shared Visibility type exported from the schema module.

Access:
- New canView(content, viewer, { asDirectLink }) helper in auth.server.ts
  centralises the rule: public → anyone; unlisted → anyone on direct
  link; private → owner only.
- routes.$id and activities.$id loaders return 404 (not 403) when
  canView rejects, so existence of private content isn't leaked.
- Detail pages emit Open Graph + Twitter Card meta on public/unlisted
  content only.

Editing:
- Visibility <select> on routes/:id/edit with owner-only access.
- Activity detail page gets a small visibility form + set-visibility
  action intent (no separate activity-edit page needed).
- EN + DE i18n under routes.visibility.* and activities.visibility.*.

Listings:
- Listing helpers listPublicRoutesForOwner / listPublicActivitiesForOwner
  for cross-user queries. Existing owner-scoped listRoutes/listActivities
  stay — owners see their own content regardless of visibility.

Public profile:
- /users/:username is now truly public. Renders the user's public
  routes + activities, 404s when no public content exists AND viewer
  isn't the owner (prevents account enumeration).
- Owner sees a short "this is your profile" note linking to settings.
- Open Graph meta (og:type=profile) for shareable preview.

Privacy manifest:
- Added a bullet noting public content is world-visible on profile
  and indexable by search engines.
- Bumped PRIVACY_LAST_UPDATED to 2026-04-20 + rendered legal-archive
  snapshot.

Tests:
- 13 unit tests for canView covering the full matrix.
- 6 E2E tests in e2e/public-content.test.ts covering:
  - Private route → 404 for logged-out visitor
  - Public route → reachable + OG tags present (og:title, og:type,
    og:site_name)
  - Owner still sees own private content
  - Profile 404 when no public content
  - Profile renders when at least one public route exists
  - Unlisted route reachable via direct URL but hidden from profile
- Test file runs serially (describe.configure mode=serial) to avoid
  WebAuthn virtual-authenticator races under Playwright's default
  parallel workers.
- New public-content Playwright project added to config.

Rollout safety: every existing row in prod keeps visibility='private'
by default — nothing becomes visible to outsiders until an owner
explicitly opts in.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/db/src/schema/journal.ts

@@ -58,6 +58,15 @@ export const magicTokens = journalSchema.table("magic_tokens", {
   createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
 });
 
+/**
+ * Visibility for routes and activities. Stored as a plain text column so we
+ * can extend without a migration. See spec `public-content-visibility`.
+ *  - private: only the owner can view
+ *  - unlisted: anyone with the direct URL can view; excluded from listings
+ *  - public: anyone can view; appears in listings and profiles
+ */
+export type Visibility = "private" | "unlisted" | "public";
+
 export const routes = journalSchema.table("routes", {
   id: text("id").primaryKey(),
   ownerId: text("owner_id")
@@ -74,6 +83,7 @@ export const routes = journalSchema.table("routes", {
   dayBreaks: jsonb("day_breaks").$type<number[]>(),
   tags: jsonb("tags").$type<string[]>(),
   plannerState: bytea("planner_state"),
+  visibility: text("visibility").$type<Visibility>().notNull().default("private"),
   createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
   updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
 });
@@ -107,6 +117,7 @@ export const activities = journalSchema.table("activities", {
   elevationLoss: real("elevation_loss"),
   photos: jsonb("photos").$type<string[]>(),
   participants: jsonb("participants").$type<string[]>(),
+  visibility: text("visibility").$type<Visibility>().notNull().default("private"),
   createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
 });
 

packages/i18n/src/locales/de.ts

@@ -186,6 +186,21 @@ export default {
         openInPlanner: "Im Planer öffnen",
         uploadGpx: "oder eine GPX-Datei hochladen",
       },
+      visibility: {
+        label: "Sichtbarkeit",
+        private: "Privat",
+        unlisted: "Nicht gelistet (nur mit Link sichtbar)",
+        public: "Öffentlich (für alle sichtbar)",
+        privateHelp: "Nur du kannst diese Route sehen.",
+        unlistedHelp: "Jede:r mit der URL kann sie ansehen; sie erscheint nicht auf deinem öffentlichen Profil.",
+        publicHelp: "Sichtbar für alle, auch nicht eingeloggte Besucher:innen; erscheint auf deinem öffentlichen Profil.",
+      },
+    },
+    profile: {
+      ownNote: "Das ist dein Profil — Besucher:innen sehen nur Inhalte, die du als öffentlich markiert hast.",
+      goToSettings: "Zu den Einstellungen",
+      noPublicRoutes: "Noch keine öffentlichen Routen.",
+      noPublicActivities: "Noch keine öffentlichen Aktivitäten.",
     },
     activities: {
       title: "Aktivitäten",
@@ -196,6 +211,12 @@ export default {
       delete: "Aktivität löschen",
       deleteConfirm: "Möchtest du diese Aktivität wirklich löschen?",
       importedFrom: "Importiert von {{provider}}",
+      visibility: {
+        label: "Sichtbarkeit",
+        private: "Privat",
+        unlisted: "Nicht gelistet (nur mit Link sichtbar)",
+        public: "Öffentlich (für alle sichtbar)",
+      },
     },
     settings: {
       title: "Einstellungen",

packages/i18n/src/locales/en.ts

@@ -186,6 +186,21 @@ export default {
         openInPlanner: "Open in Planner",
         uploadGpx: "or upload a GPX file",
       },
+      visibility: {
+        label: "Visibility",
+        private: "Private",
+        unlisted: "Unlisted (only people with the link)",
+        public: "Public (anyone on the internet)",
+        privateHelp: "Only you can see this route.",
+        unlistedHelp: "Anyone with the URL can view it; it won't appear on your public profile.",
+        publicHelp: "Visible to anyone, including logged-out visitors; listed on your public profile.",
+      },
+    },
+    profile: {
+      ownNote: "This is your profile — visitors see only what you've marked public.",
+      goToSettings: "Go to settings",
+      noPublicRoutes: "No public routes yet.",
+      noPublicActivities: "No public activities yet.",
     },
     activities: {
       title: "Activities",
@@ -196,6 +211,12 @@ export default {
       delete: "Delete Activity",
       deleteConfirm: "Are you sure you want to delete this activity?",
       importedFrom: "Imported from {{provider}}",
+      visibility: {
+        label: "Visibility",
+        private: "Private",
+        unlisted: "Unlisted (only people with the link)",
+        public: "Public (anyone on the internet)",
+      },
     },
     settings: {
       title: "Settings",