[sandervanhooft]

When an item is created, ItemObserver::created() skips the new item notifications only when the item itself is private. It doesn't check the project. An item created in a private project still notifies every receiver in Settings → Notifications, unless that receiver is limited to other projects. So the title and content of an item in a private project can end up in a public Slack or Discord channel.

This adds a project check to that loop. Items in a private project now notify only receivers that selected that project in their project list. Receivers without a project list are skipped, the same as for private items.

Why a receiver that selected the private project is still notified: an admin picked that project for that receiver on purpose, so it's most likely an internal channel for the project. If you'd rather private projects send nothing at all, like private items, it's a one-line change.

The English helper text for the project select now says so. Other locales keep their current text.

Tests

• Item in a private project sends nothing to a receiver without a project list
• Item in a private project notifies only the receiver that selected that project, not one limited to another project or one without a list