feat(api): let invited collaborators see private tracks they're on

[raymondjacobson]

Follow-up to the collaborative-tracks feature: a collaborator can now see a private (unlisted) track they've been invited to, so the feature works end-to-end on private tracks (their profile, feeds, etc.).

Background

The single-track endpoint already sets IncludeUnlisted: true, so the track page and the invite notification's useTrack already loaded an unlisted track. But the profile and other get_tracks paths don't set that flag, so a private collaboration was hidden from the collaborator everywhere except the direct track link.

Changes

• get_tracks.sql — an unlisted track is also visible to a user who is an active collaborator on it (status IN ('pending','accepted')). Pending is included so an invited collaborator can view the track to decide. Scoped to collaborator_user_id = @my_id, so it never leaks to other viewers.
• v1_users_tracks.go — surface a user's own unlisted accepted collaborations on their own profile (guarded by @my_id = @user_id); hidden from everyone else.

Safety / performance

• No leak: visibility is tied to the requesting user being the collaborator. A rejected collaborator loses access. Verified by test (non-collaborator and rejected both get nothing).
• The get_tracks EXISTS only runs for unlisted tracks (the OR short-circuits public ones) and only over the already-bounded @ids set, served by the track_collaborators PK — not the kind of unbounded scan that bit feat(api): collaborative tracks — notifications, embed, profile + dashboard merge #932.

Tests

TestCollaboratorSeesPrivateTrack: a pending collaborator sees the private track; a non-collaborator (user 2) does not; a rejected collaborator does not. Existing collaborator + user-tracks suites still pass.

🤖 Generated with Claude Code