feat(api): make default template visibility (public/private) configurable via TEMPLATES_DEFAULT_PUBLIC #3703

Summary

Make the default visibility of newly created templates configurable (public vs private) via an opt-in environment variable, instead of it being fixed in code.

This is not about forcing templates to be public — it is about giving self-hosted operators a single switch to choose the default visibility that fits their deployment:

• leave it unset / false → keep the current private-by-default behavior (unchanged);
• set it true → new templates default to public (useful for deployments that want a shared, platform-wide catalog).

Background

Today the public flag for a newly created template is effectively hardcoded and cannot be configured:

• packages/api/internal/handlers/template_request_build_v3.go sets public := false for a new template (V2 and V3 both funnel through requestTemplateBuild); it only becomes true by inheriting from a previous same-alias template owned by the same team.
• The V1 path (deprecated_template_request_build.go → buildTemplate → RegisterBuildData) leaves Public at its zero value false.
• The request bodies (TemplateBuildRequestV3 etc.) expose no public field, and there is no env var or feature flag controlling the default.

So an operator who wants a different default visibility must fork and edit Go code — there is no configuration knob either way.

Proposal

Add an opt-in environment variable TEMPLATES_DEFAULT_PUBLIC that controls the default visibility of newly created templates:

• Read in template.RegisterBuild — the single funnel all three create paths (V1/V2/V3) go through.
• Applied after the existing rebuild-inheritance (data.Public = previous.Public) so the configured default governs both the stored DB row and the API response.
• Default (unset / false / unparseable) preserves today's private-by-default behavior — fully backward compatible.

Per-template overrides (request-body / API) could be layered on later; this issue only asks for a configurable default.

Scope / notes

• Affects only newly created/rebuilt templates; existing templates are untouched.
• Default off → no behavior change for anyone who does not set it.
• PR attached.