fix: restoring history cannot change an account's privacy

[blaipr]

AccountUseCases::restoreModified() copies isPrivate and isPrivateGroup straight from the
history snapshot, and the repository's restoreModified() excludes userId/userGroupId from the
UPDATE but not those two — so a restore wrote them back unconditionally.

On the edit screen the same two flags are gated: AccountForm::constrainPrivacyToPermission()
allows them only for an application administrator, or for the owner holding isAccPrivate() (the
group holding isAccPrivateGroup()). A history DTO never passes through AccountForm, so nothing
re-applied that rule on the way back in.

SaveEditRestoreController checks only ACCOUNT_EDIT_RESTORE, which AccountPermission buckets
with plain edit access. So anybody the account was shared with for editing could restore an old
version and, with it, set the account private — and AccountAcl tests privacy before the
administrator branch, so a private account disappears for account administrators too. Or strip the
privacy from an account that had it.

The same shape, one field over

This method already refuses to take the owner and the group from the snapshot: restoreModified()
takes explicit $changeOwner / $changeUserGroup flags, computed from userCanChangeOwner() and
userCanChangeGroup(), because restoring used to revert ownership past the ACL. Privacy is the same
question asked about a different pair of columns, and it was still being answered by the snapshot.

The fix puts the decision in the same place, beside those two: constrainPrivacyToPermission()
mirrors the form's rule and zeroes what the caller may not set, before the model is built.

Tests

testRestoreModifiedCannotMakeAnAccountPrivate restores a snapshot with both flags set as an
ordinary user and asserts the model reaching the repository has both at zero. Mutation-verified:
reverting src/ fails it.

The two existing restore tests built their expectation straight from the snapshot, so they now say
what the method actually promises — the privacy flags are decided, not copied.