feat(todo): M4.b — tasks adopt the unified visibility system

Fourth consumer of @mana/shared-privacy. Tasks now carry a
VisibilityLevel flipped via <VisibilityPicker> in the Todo DetailView;
a new todo.tasks embed source powers the "public roadmap" use-case
(mark a handful of tasks public, drop the embed on the Website).

Changes:
- todo/types: visibility + unlistedToken + visibilityChangedAt +
  visibilityChangedBy on LocalTask; Task (UI type) requires visibility
- todo/queries: toTask forwards visibility with 'space' fallback for
  legacy rows (pre-M4.b records have no field set; Dexie hook stamped
  'space' since spaces-foundation v28)
- todo/stores/tasks: createTask stamps
  defaultVisibilityFor(activeSpace.type); new setVisibility(id, level)
  mints/clears the unlisted token on the transition boundary and
  emits cross-module VisibilityChanged
- todo/views/DetailView: <VisibilityPicker> dropped in as the first
  prop-row above Priorität so the user sees exposure state at a glance
  whenever they open a task

website embed:
- website-blocks/moduleEmbed/schema: 'todo.tasks' added to
  EmbedSourceSchema; filter docstring explains the todo-specific shape
  (status + tagIds for the typical "shipped items with #public" filter)
- website/embeds: resolveTodoTasks gates hard on canEmbedOnWebsite,
  maps the optional status filter ('completed' → isCompleted=true),
  joins the N:N taskTags table for the optional tagIds filter, sorts
  newest-first with id as stable tiebreaker. Inlined EmbedItem is
  whitelist-only — title + status label ('Erledigt' / 'In Arbeit').
  Description, subtasks, LLM-labels, due-dates, and project
  memberships stay out of the public snapshot (per plan §2 redaction
  policy)

Verified:
- pnpm check (web): 7450 files, 0 errors
- pnpm test todo + website: 38/38

Next: M4.c — Goals. Lives under $lib/companion/goals/ (not in the
standard /modules/ tree), so the adoption path is slightly different
and gets its own commit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/website-blocks/src/moduleEmbed/schema.ts

@@ -26,7 +26,12 @@ export const EmbedResolvedSchema = z.object({
  * Supported embed sources. Add new sources here + a matching provider
  * in the editor's publish resolver.
  */
-export const EmbedSourceSchema = z.enum(['picture.board', 'library.entries', 'calendar.events']);
+export const EmbedSourceSchema = z.enum([
+	'picture.board',
+	'library.entries',
+	'calendar.events',
+	'todo.tasks',
+]);
 export type EmbedSource = z.infer<typeof EmbedSourceSchema>;
 
 export const ModuleEmbedSchema = z.object({
@@ -42,8 +47,11 @@ export const ModuleEmbedSchema = z.object({
 	 *   library.entries: { isFavorite?, status?, kind? }
 	 *   picture.board:   ignored (board is the source)
 	 *   calendar.events: { upcomingDays?, tagIds? } — omit upcomingDays
-	 *                    to include past events; tagIds AND-filter on
+	 *                    to include past events; tagIds OR-filter on
 	 *                    event tag assignments
+	 *   todo.tasks:      { status?, tagIds? } — typical public-roadmap
+	 *                    shape: status='completed' filters to shipped
+	 *                    items; tagIds restricts to a "public" label
 	 */
 	filter: z
 		.object({