fix(user): syncBookmarks のデフォルト is_visible を 0 に修正、テスト強化 (SOR-18)

- syncBookmarks の INSERT も is_visible=1 → 0 に変更
- makeVisible ヘルパーにステータスアサーション追加
- デフォルト非公開を直接検証するテスト追加

Author: Sora4431

apps/api/src/services/user.service.ts

@@ -205,7 +205,7 @@ export class UserService {
     const now = getCurrentTimestamp();
     const stmts = validIds.map(id =>
       this.db
-        .prepare('INSERT OR IGNORE INTO user_bookmarks (user_id, itinerary_id, is_visible, created_at, updated_at) VALUES (?, ?, 1, ?, ?)')
+        .prepare('INSERT OR IGNORE INTO user_bookmarks (user_id, itinerary_id, is_visible, created_at, updated_at) VALUES (?, ?, 0, ?, ?)')
         .bind(userId, id, now, now)
     );
     const results = await this.db.batch(stmts);

apps/api/test/users-profile.test.ts

@@ -83,11 +83,12 @@ async function registerAndGetToken(username: string, email: string, password = '
 }
 
 async function makeVisible(token: string, itineraryId: string): Promise<void> {
-  await app.request(`/api/v1/users/me/bookmarks/${itineraryId}/visibility`, {
+  const res = await app.request(`/api/v1/users/me/bookmarks/${itineraryId}/visibility`, {
     method: 'PATCH',
     headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
     body: JSON.stringify({ is_visible: true }),
   }, env);
+  expect(res.status).toBe(200);
 }
 
 describe('PATCH /api/v1/users/me/profile', () => {
@@ -313,6 +314,20 @@ describe('GET /api/v1/users (public feed)', () => {
     expect(json.data.hasMore).toBe(false);
   });
 
+  it('new itinerary is private by default (not visible in public feed)', async () => {
+    const token = await registerAndGetToken('defaultprivateuser', 'defaultprivate@example.com');
+
+    await app.request('/api/v1/itineraries', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+      body: JSON.stringify({ title: 'デフォルト非公開しおり' }),
+    }, env);
+
+    const res = await app.request('/api/v1/users', {}, env);
+    const json = await res.json() as { data: { items: unknown[] } };
+    expect(json.data.items).toHaveLength(0);
+  });
+
   it('returns public bookmarks with username', async () => {
     const token = await registerAndGetToken('feeduser', 'feed@example.com');