fix(api): restrict public sharing to the documented aggregate overview #1114

Track the confirmed high-severity finding in private report GHSA-63mv-3x64-72w2, currently in triage.

Public sharing is presented as an overview, but its API permissions also include raw custom-event properties and error diagnostics. Personal information in those payloads can consequently become visible to anonymous viewers.

The local reproduction exercised the real query route and SQL builders with synthetic data and confirmed the exposure. The same request was denied for a private website. The affected files matched upstream main at the time of the audit. Detailed evidence and reproduction steps are in the linked private report.

Suggested acceptance criteria:

• Public sharing permits only the documented aggregate overview.
• Raw events, diagnostic text, arbitrary property values, and visitor/session identifiers require authenticated website permissions.
• Public trait filters and small cohorts receive an explicit privacy policy.
• Route-level tests reject anonymous requests for these private data surfaces while preserving permitted overview queries.

Prepared with Codex; no live customer data was accessed. This issue tracks the existing security report rather than a separate finding.