fix(admin): stop hiding other teams' public rows when filtering by team

[Yosiefeyob]

Pull Request

🔗 Related Issue

Closes #6193

---

📝 Summary

Admin list endpoints hid globally-public rows owned by other teams when filtering by team. These queries are hand-built in admin.py rather than going through BaseService, and gated the globally-public condition behind include_public — which the main resource tables never set.

All of them now route through a shared team_scoped_conditions() helper, extracted to module scope in base_service.py so admin.py and the service layer use one definition. Team filtering includes globally-public rows by default; callers pass include_public=false to opt out.

Scope is 19 endpoints, not the 12 in the issue. /admin/servers/*, /admin/a2a/* and /admin/tool-ops/partial have the same bug and are worse — no include_public parameter at all, so public rows were suppressed with no way to see them.

On the fix the issue suggests: it proposes dropping the include_public gate, on the basis that nothing in the UI sets it. The "View Public" toggle in the server add/edit modals does set it (filters.js, gateways.js, tools.js, prompts.js, resources.js, search.js), and dropping the gate would have made that checkbox a no-op. Instead the default is flipped and the modals send the negative explicitly, so the toggle keeps working with no user-visible change.

---

📏 Reviewability

• This PR has one clear purpose
• The linked issue is not labeled triage
• Unrelated bugs or improvements are tracked in separate issues/PRs
• Tests are included with the code they validate
• If AI-assisted, I understand and can explain the generated changes

---

🏷️ Type of Change

• Bug fix
• Feature / Enhancement
• Documentation
• Refactor
• Chore (deps, CI, tooling)
• Other (describe below)

---

🧪 Verification

Manual check in the Admin UI, two builds against the same database — main on one port, this branch on another. Four gateways seeded: one team-scoped in team alpha, one team-scoped in team beta, one public owned by beta, one public with no team. Selecting team alpha, then MCP Servers:

Row	main	this branch
alpha, team-visibility	visible	visible
beta, team-visibility	hidden	hidden
beta, public	hidden	visible
no team, public	hidden	visible

Same result on the Tools tab. Other teams' team-scoped rows stay hidden, so nothing widened beyond public.

New tests mutation-checked: making the helper stop including public rows fails 6 of 14; reverting a single endpoint to an inline condition list fails 1.

Check	Command	Status
Lint suite	make lint	not run — ruff clean on changed files
Unit tests	make test	not run — 1333 passed across admin + services + new tests; 2333 passed in the JS suite
Coverage ≥ 80%	make coverage	not run

---

✅ Checklist

• Code formatted (make black isort pre-commit)
• Tests added/updated for changes
• Documentation updated (if applicable)
• No secrets or credentials committed

---

📓 Notes (optional)

tests/js/admin-view-public.test.js covers this toggle but is not collected — tests/js/** has been commented out in vitest.config.js since #3137 split admin.js into modules. Three of its assertions encode the previous contract and would need updating if that suite is re-enabled. Left alone here rather than expanding this change.