People: Withhold names of private and hidden persons

As a library owner, I want to flag people as "private" or "hidden" to prevent non-privileged users and visitors from seeing their identities.

What Problem Does This Solve?

Libraries are often shared with accounts that may browse pictures without seeing everything about them: a read-only account for the family, a shared workstation, a household tablet. Some of the people in a library are not meant to be named to those accounts at all - a child, a client, a former partner. Naming people is what makes a library searchable, so "do not name them" is not an answer.

Two options in the person edit dialog under People express this, and they need to mean the same thing everywhere a name can appear.

Behavior

Option	Effect
Private	The person is withheld from accounts that are not permitted to see private content.
Hidden	The same, and the person is also left out of People > Recognized for everyone.

For an account that may not see them, a withheld person:

• does not appear under People, or in the name suggestions when tagging a face
• is not named in a picture's People list, and their face is not listed there
• does not appear when browsing faces
• has their name kept out of automatically generated picture titles, captions and search keywords

Accounts that are permitted to see private content see the person, their faces and their name in every view.

What This Does Not Do

• The person's pictures stay visible. Anyone who may browse the library still sees the pictures; only the name is withheld. Keeping a person's pictures out of the library is a separate request (#757).
• It is not encryption, and it is not a password prompt. See #325 for password-protected access.

Acceptance Criteria

• Marking a person Private MUST withhold their name from every view available to an account that is not permitted to see private content.
• Marking a person Hidden MUST do the same, in addition to leaving the person out of People > Recognized for every account.
• Automatically generated titles, captions and search keywords MUST NOT contain the name of a person marked Private or Hidden.
• Changing either option MUST update the generated titles, captions and keywords of that person's existing pictures.
• An account that is permitted to see private content MUST continue to see the person, their faces and their name in every view.
• The person's pictures MUST remain visible and searchable; withholding a name MUST NOT hide the pictures.
• Both options MUST be covered by automated tests, including the permitted-account case.
• The Private and Hidden options SHOULD be explained in the User Guide.