[sandervanhooft]

Through MCP, every item is created as a public item. create-item has no private flag, so the new item notification goes out as soon as the item is saved. Making the item private afterwards is too late, and there was also no MCP tool to do that.

Changes

• create-item accepts an optional private boolean. Admins and employees can create the item as private from the start, so ItemObserver::created() sends no notification. Regular users who pass private: true get an error, the same way comment-on-item handles private notes.
• New set-item-visibility tool (item, private) makes an existing item private or public. It's available to admins and employees only (hidden from other users via shouldRegister()) and idempotent: it reports when the item already has that visibility. The update goes through the observer, so the "made private"/"made public" activity is logged as usual.
• The server instructions mention both. The MCP docs page lists the new tool automatically from RoadmapServer::TOOLS.

Tests

• Admins and employees can create a private item, and no notification is queued
• Regular users can't create private items
• set-item-visibility makes an item private (admin and employee) and public again
• Regular users can't change visibility
• The tool listing shows set-item-visibility to employees only