Return public engagements when private inclusion is unauthorized

[jmgasper]

When callers without private-list access send includePrivate=true, the engagement list returns HTTP 401 and breaks the opportunities page. This change silently disables the flag and returns the normal public results, preserving pagination, filters, and public-field redaction.

Administrator/Talent Manager/M2M access, member-scoped appliedByMe access, and explicit ON_HOLD authorization remain unchanged. API documentation and authorization regression tests cover the fallback.

Validation:

• pnpm lint and pnpm build pass.
• Controller, service, and query DTO suites: 94 tests pass.
• includePrivate Access HTTP suite: 12 tests pass.
• Full legacy authentication suite: 35 pass, 7 fail. The same seven failures reproduce on unchanged base commit 448c6d7 with the same isolated test setup: five stale detail-read expectations and two outdated application-create routes.

Companion UI role alignment: topcoder-platform/platform-ui#2483