Expose team visibility through MCP

MCP clients cannot determine whether a team is public or private: tasklie_list_groups returns only id/key/name, and task get/create responses do not establish the containing team's visibility. During ADT-193 staging work, this prevented verifying that a requested private ADT follow-up (ADT-211) could safely hold identifying conflict details.

Expose the team's existing authoritative visibility setting in MCP team discovery and relevant task context. Return a documented field/value rather than inferring privacy from team name, task access, or successful creation. Preserve existing authorization boundaries; do not reveal inaccessible teams or their membership.

Acceptance:

• MCP team results include explicit public/private visibility (or the application's equivalent authoritative values).
• Task consumers can resolve the task's team visibility without guessing.
• Response schema/tool descriptions document visibility semantics and distinguish unknown/unavailable from private.
• Tests cover accessible public/private teams and unauthorized access; existing clients remain compatible.

Requested by ParadauxIO in #staging-server, message1562731269417345076. This task exposes visibility; it does not request changing team privacy or adding a task-level privacy setter.