fix: restore legacy training data hidden by new visibility schema (migrate-on-read)

Records written before the visibility field existed carry none; the new
fail-closed authorization treated missing visibility as invalid, making every
legacy group unlistable and unreadable. Add resolved_visibility(group) that
derives effective visibility for legacy records only (owner present => private,
absent => public), leaves explicit-malformed visibility fail-closed (None), and
never derives demo/hidden. Apply it at every list, authorization, chat, and
analytics boundary while keeping demo and hidden-preview paths raw and
owner_user_id-based private isolation intact. No persisted data is rewritten.

Backend full suite passes 517; frontend 26/26; production build passes.

docs/test-evidence/2026-08-24-training-security-review.md

@@ -146,6 +146,14 @@ smoke test.
   frontend and **81/81** focused backend checks; final cross-cutting scope also
   **passed**. Both exact verdicts had empty security and logic arrays.
 - Independent local code/security gate: **8/8 scopes passed**.
+- Post-push operator report of missing legacy training data traced to the new
+  fail-closed visibility schema. Legacy records lacking `visibility` were rejected
+  by authorization. Fixed with migrate-on-read `resolved_visibility` (owner present
+  => private, absent => public; malformed explicit stays fail-closed; demo/hidden
+  never derived). Applied at every list/authorization/chat/analytics boundary.
+- Post-fix evidence: legacy/resolved regression **13 passed**; blocker file **55
+  passed**; full backend **517 passed in 80.97s**; frontend unit **26 passed**;
+  production build **passed**; compileall and `git diff --check` passed.
 - No live OAuth provider, production runtime, deployment, stage, commit, push,
   reset, or stash verification is claimed.