feat: treat unlisted configs same as public, exclude from explore

Unlisted configs are now served through the public API endpoint and
shown on user profile pages, but filtered out of the explore page.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: fullstackjam

src/routes/[username]/+page.server.ts

@@ -65,9 +65,9 @@ export const load: PageServerLoad = async ({ params, platform, locals, request,
 	if (!profileUser) throw error(404, 'User not found');
 
 	const configsResult = await env.DB.prepare(
-		'SELECT id, slug, name, description, base_preset, packages, install_count, updated_at FROM configs WHERE user_id = ? AND visibility = ? ORDER BY install_count DESC'
+		'SELECT id, slug, name, description, base_preset, packages, install_count, updated_at FROM configs WHERE user_id = ? AND visibility IN (?, ?) ORDER BY install_count DESC'
 	)
-		.bind(profileUser.id, 'public')
+		.bind(profileUser.id, 'public', 'unlisted')
 		.all<any>();
 
 	const configs = configsResult.results || [];

src/routes/api/configs/public/+server.ts

@@ -7,11 +7,14 @@ export const GET: RequestHandler = async ({ platform, url }) => {
 
 	const username = url.searchParams.get('username');
 	const sort = url.searchParams.get('sort') || 'recent';
+	const visibility = url.searchParams.get('visibility');
 	const limit = Math.min(parseInt(url.searchParams.get('limit') || '50'), 100);
 	const offset = Math.max(parseInt(url.searchParams.get('offset') || '0'), 0);
 
 	let orderClause: string;
-	let whereClause = `c.visibility = 'public'`;
+	let whereClause = visibility === 'public'
+		? `c.visibility = 'public'`
+		: `c.visibility IN ('public', 'unlisted')`;
 
 	if (!username) {
 		whereClause += ` AND NOT (u.username = 'openboot' AND c.slug = 'default')`;

src/routes/explore/+page.svelte

@@ -33,7 +33,7 @@
 
 		loading = true;
 		try {
-			const response = await fetch(`/api/configs/public?sort=${sortBy}&limit=${limit}&offset=${offset}`);
+			const response = await fetch(`/api/configs/public?sort=${sortBy}&limit=${limit}&offset=${offset}&visibility=public`);
 			if (response.ok) {
 				const data = await response.json();
 				if (reset) {