Make it yours: a private copy is born private, and the daily limit holds on every way to copy #888

Pillar: P2 Explorer (umbrella #588). Follows #886 (#852, #853), from its review.

1. A private copy is born private. Make it yours forks the repository (which inherits the original's visibility, public for a public app) and then sets it private, so for a moment the copy is public. Pass the chosen visibility into the fork itself (core/repos.ts forkRepo), so it never exists public.
2. The daily copy limit holds on the plain fork too. POST /:owner/:name/fork followed by enabling an app makes the same copy without the limit. Count and refuse there as well (forks are what the limit counts).
3. No race past the limit. The count and the fork are separate statements; two requests at once could both pass. Check and insert in one transaction, or re-check after the insert and undo.

Done means reachable: tests for each — a private copy never visible as public, the plain fork refused past the limit, and two concurrent copies at the limit making one.