feat: ingest private events; surface public-only

The DB now stores everything GitHub will give us, the API only ever
returns public events (for now).

Endpoint switch in the github poller: when GITHUB_TOKEN is set we
hit /users/{u}/events (public + private), otherwise fall back to
/users/{u}/events/public. Either way each event's top-level `public`
boolean is captured into a new column.

Schema:
  migration 0003_event_public.sql adds events.public BOOLEAN NOT NULL
  DEFAULT true, plus an index on (public, occurred_at DESC).

Wire:
  Event gains a `public: bool` field.
  EventQuery gains `include_private: bool` (default false).
  list_events and source_summaries gate on it.
  moments-api pins include_private = false at every call site —
  threading it as a query param is a future-auth concern, not now.

The default-true on the column keeps existing rows correct: the 11
events already in the DB came from /events/public and are genuinely
public.

After this change, clear poller_state so the next worker run does a
fresh backfill via /events:

  DELETE FROM poller_state WHERE source = 'github';

Tests: +2 in github poller (private flag captured, default-public
on missing field) — 10 total green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/moments-core/src/lib.rs

@@ -17,7 +17,7 @@ pub enum StoreError {
 #[async_trait]
 pub trait EventReader: Send + Sync {
     async fn list_events(&self, query: &EventQuery) -> Result<Vec<Event>, StoreError>;
-    async fn source_summaries(&self) -> Result<Vec<SourceSummary>, StoreError>;
+    async fn source_summaries(&self, include_private: bool) -> Result<Vec<SourceSummary>, StoreError>;
 }
 
 /// Write-side port consumed by `moments-worker`. Idempotent upserts on `id`.

crates/moments-core/src/presentation/github.rs

@@ -383,6 +383,7 @@ mod tests {
             source: Source::Github,
             action: action.into(),
             occurred_at: Utc.with_ymd_and_hms(2026, 4, 14, 10, 0, 0).unwrap(),
+            public: true,
             payload,
         }
     }