fix: keep unlisted projects and events out of public directories

[abdulahaddayater]

Summary

Unlisted is labeled “Direct link only,” but the public Projects and Events lists treated unlisted the same as public. An unlisted project still showed up in the directory for the owner and for anyone else.

• The public Projects and Events lists now include only public entries.
• An unlisted project or event still opens from its direct link.
• The owner can still see their own unlisted entries when listing their own work, such as with Personal turned on.
• A request for visibility=unlisted no longer returns every unlisted project to a logged-out visitor.

Test plan

• Create a project, set visibility to Unlisted, and open Projects with Personal off. The project is not in the directory.
• Open that project from its direct link. The page still loads.
• bun run test -- src/__tests__/projects.test.ts in plugins/projects passes, including the new unlisted-directory test.
• Repeat the directory check for an unlisted event.