fix(http): authenticated timeline reads include author-private entries

Unscoped timeline reads use account-specific visibility and return private originals or repost projections to their author. In-process post events can also insert these entries into the shared feed.

Limit the unscoped feed to public publications while retaining private access in author-scoped and personal archive reads. Apply the same boundary to client-side post-change reconciliation.