[nkboedecker]

Summary

A tag name or a shelf's contents can reveal what a hidden copy is, so neither should be visible to someone who can't see the copy. This closes two places where they could be.

• A library's tag list now includes a tag only if it is on a copy the reader can see. A tag on no copy is a leftover from a copy that was re-tagged or deleted, so it is listed only to those who could see every copy it might have been on: the owner, or an editor if the library lets editors see personal copies.
• Taking a copy off a shelf now answers the same for a hidden copy as for one that isn't there, so it can't be used to find out whether a hidden copy is on a shelf.

This is the fix half of the tags and shelves work in #8. It is independent of the pages there and passes every check without them, so it can merge first.

Not in this PR

• DELETE /api/v1/tags/{id} lets an editor delete a tag that only hidden copies use.
• Creating a tag returns a conflict for a name that already exists, which confirms a hidden name.
• Fix both when tag management gets a page.

Checklist

• The PR title is a Conventional Commit.
• Tests are added, including an authorization-denied test for each endpoint. No endpoint is added; the new tests cover both leaks at the API.
• Docs are updated.
• CHANGELOG.md has a line under Unreleased, or this change isn't user-visible.
• Commits are signed and have a Signed-off-by line.

Breaking changes

None. GET /api/v1/libraries/{id}/tags now returns fewer rows to readers who can't see some copies, which is the privacy fix above.

Security-sensitive areas

• Authorization: the tag list filter and the visibility check on shelf removal.

AI assistance

Claude Code wrote this change and its tests. An advisor review ran before it was presented, and it found both gaps in my first version of the tag filter and the shelf removal. The maintainer reviewed and made the commit.