Add task visibility fields and migrate existing access safely #208

Work

Add visibility and any necessary ownership fields to the existing project task model. Preserve ProjectId, task numbers, canonical references, parents and existing identities. Validate allowed visibility values and project/organization constraints. Audit actual previous access before selecting migration defaults.

Acceptance

• No task detached from its project or renumbered.
• Migration neither exposes previously restricted work nor silently removes legitimate access without a documented resolution.
• Legacy access patterns not representable by the new choices are reported for a decision rather than guessed.
• New task creation defaults and subtask inheritance follow #207.
• Dry run, representative fixtures and rollback/forward recovery documented.

Dependencies

#207 access contract. No new scope-local sequence or qualified non-project task reference.