Isolate private group publishing policy

[MicrowaveDev]

Summary

• add a default-off PrivateGroup module and additive private_group group type
• normalize private groups to closed, non-public, encrypted state and keep that type stable
• route private post manifests through an explicit private hook instead of public publishing hooks
• limit shared private-post mutation to the original author while preserving existing group behavior
• document the module boundary and add focused policy/integration coverage

Rollout

PRIVATE_GROUP_ENABLED defaults to disabled. Existing personal_chat groups and browser-first direct ChatEvent conversations are unchanged. This establishes the first boundary from the migration plan in #1307 without exposing unfinished private-group chat to users.

Validation

• npx mocha --require tsx test/privateGroup.test.ts (4 passing)
• focused Docker policy/group integration run (5 passing)
• npm run test:docker (620 passing, 11 pending)
• git diff --check