Private projects are now properly invisible to the public

If you marked a project as private, the public blog routes used to be inconsistent about enforcing that — some pages 404'd, others quietly served the content anyway.

This release adds a proper visibility middleware that runs at the layout level for every project route:

• Private or non-existent projects return a clean 404 across every reader-facing page.
• The sitemap excludes private projects entirely, so search engines never get hints that they exist.
• Article listings, search results, category pages, and tag pages all consistently filter out private content.

If you've been hesitant to use the private visibility setting because the enforcement felt fuzzy, this is the release that makes it rock-solid.