Restrict guest visibility to accessible spaces

[ArtyomSavchenko]

Problem

Guest / ReadOnlyGuest / DocGuest accounts could see far more than intended:

• People: Person/Employee live in the shared system space contact.space.Contacts, so any guest could browse every person in the workspace regardless of project membership — while the @-mention picker was simultaneously broken, always empty, since searchFulltext excludes system spaces for these roles.
• Sensitive classes: Collaborator, love.class.MeetingMinutes/RoomInfo, hr.class.Request, notification.class.PushSubscription, guest.class.PublicLink all live in core.space.Workspace (a hardcoded mainSpace, never filtered by role) — guests could read other people's meeting attendance, HR requests, push-subscription records, and share links.
• Disabled modules: turning an app off for a role in Settings → Guest permissions only hid the sidebar icon and blocked writes; the app's objects still showed up in search/mentions and stayed readable via plain findAll.
• Non-obvious behavior join behaviour: Now there is a separate flag indicating whether guests need to be added to the space, but at the same time OnEmployeeCreate copied the anonymous read-only account's space membership onto every new named Guest, so a guest could inherit access to any space ever marked "visible to anonymous," regardless of that space's auto-join settings.

Changes

foundations/server/packages/middleware/src/spaceSecurity.ts (new logic factored into guestVisibility.ts to keep this file from growing further):

• findAll/searchFulltext: open (no _id) Person/Employee queries are narrowed to accounts sharing a real space with the caller; _id/$in queries bypass (resolving an already-visible reference). searchFulltext now lets contact.space.Contacts through for these roles but applies the same allow-list to results, fixing the empty picker without exposing everyone.

• findAll: per-class restriction for the sensitive classes above — self-scoped for Collaborator/HR Request/PushSubscription, collaborator-gated for MeetingMinutes, denied outright for RoomInfo/PublicLink (no legitimate open-browse path). love.class.Room intentionally excluded — no membership concept exists on it yet.

• findAll + searchFulltext: spaces belonging to a role-disabled ModulePermissionGroup are excluded from both, so a disabled app is fully unreachable rather than just hidden from the sidebar/search.
  server-plugins/contact-resources/src/index.ts:

• OnEmployeeCreate no longer copies the anonymous-guest account's space membership onto new named guests; only autoJoinForRoles/explicit invite grants apply.