Shared boards now show each member what they can actually see

A GitGumbo project syncs on one credential. That is fine when you are working alone and becomes a real problem the moment a board is shared: every member was seeing whatever the syncing account could see, which is not necessarily what they could see.

Marking confidential issues made this impossible to ignore. A confidential issue was arriving on the board with its title, its labels and its assignees, shown to every member of the firm — including members who would get a 404 opening that same issue in GitLab directly. We had made the board honest about what the issue was without answering who should be looking at it.

Visibility is now resolved per viewer. When you open a shared board, what renders is checked against your own provider account, not against the account that happens to run the sync. Everyone signs in with a provider account already, so the identity needed to do this was there the whole time.

One limit, stated plainly

Titles, references and links for issues above your access level are withheld. The counts on the blocked and blocking indicators are not per-viewer — they are denormalised, and making them viewer-specific needs per-link confidentiality that we do not currently store.

So a member below the access floor can learn that an issue has, say, two links, without learning what either of them is. That is a deliberate residual rather than an oversight, and it is written down as one.