fix(activity): prevent private note data leakage

[poboll]

Summary

• limit activity publication to visible notes and metadata-only rows
• require published, non-password-protected notes whose publicAt has passed
• serialize an explicit public metadata allowlist and add regression coverage for private payload leakage

Security impact

The activity publication endpoint previously called noteService.findRecent(50) without visibility or projection options. Replacing only some titles with Private note still returned the original note object, so anonymous activity responses could include private text, content, and images.

Implementation

• query notes with { metaOnly: true, visibleOnly: true }
• apply a defense-in-depth filter for the one-year window, publication state, password protection, and scheduled publicAt
• return only id, nid, title, mood, weather, bookmark, and createdAt for each published note

Verification

• GitHub Actions run 31367661319: all 9 checks passed, including lint/typecheck, Core build, Docker build, CLI/Core E2E, three test shards, GitGuardian, and the Open Source Software Supply Chain Security Scanner
• git diff --check passed

No database migration or production deployment is included. Anonymous endpoint verification remains a post-merge deployment check.

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

View complete scan results →

_{This report is generated by SafeDep Github App}