feat: ingest private events; surface public-only

The DB now stores everything GitHub will give us, the API only ever
returns public events (for now).

Endpoint switch in the github poller: when GITHUB_TOKEN is set we
hit /users/{u}/events (public + private), otherwise fall back to
/users/{u}/events/public. Either way each event's top-level `public`
boolean is captured into a new column.

Schema:
  migration 0003_event_public.sql adds events.public BOOLEAN NOT NULL
  DEFAULT true, plus an index on (public, occurred_at DESC).

Wire:
  Event gains a `public: bool` field.
  EventQuery gains `include_private: bool` (default false).
  list_events and source_summaries gate on it.
  moments-api pins include_private = false at every call site —
  threading it as a query param is a future-auth concern, not now.

The default-true on the column keeps existing rows correct: the 11
events already in the DB came from /events/public and are genuinely
public.

After this change, clear poller_state so the next worker run does a
fresh backfill via /events:

  DELETE FROM poller_state WHERE source = 'github';

Tests: +2 in github poller (private flag captured, default-public
on missing field) — 10 total green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/moments-entities/src/lib.rs

@@ -54,6 +54,10 @@ pub struct Event {
     pub source: Source,
     pub action: String,
     pub occurred_at: DateTime<Utc>,
+    /// True when the upstream marks this event as visible to anyone (e.g.
+    /// GitHub's top-level `public` flag). The DB stores everything; the API
+    /// uses this to gate what gets surfaced on the public timeline.
+    pub public: bool,
     pub payload: serde_json::Value,
 }
 
@@ -63,6 +67,9 @@ pub struct EventQuery {
     pub from: Option<DateTime<Utc>>,
     pub to: Option<DateTime<Utc>>,
     pub sources: Option<Vec<Source>>,
+    /// When false (default), only `public = true` rows are returned. The API
+    /// pins this to false today; a future authenticated path can flip it.
+    pub include_private: bool,
     pub limit: u32,
 }