Block all private lists by default, add opt-in allowlist

Previously the restriction layer relied solely on a fixed pattern list,
so any unconventionally-named private list (e.g. names other than
private@/security@) could slip through. This adds a second layer that
checks PonyMail's `private` flag on every response and blocks unless
the list is explicitly opted in via PONYMAIL_ALLOWED_LISTS.

- restrictions.js: parse PONYMAIL_ALLOWED_LISTS, add allowedFor(),
  isPrivateBlocked(), privateError(), listAllowed(). Module-load
  capture is documented inline.
- index.js: post-fetch private-flag check in search_list (including
  per-email cross-listing scan), get_email, get_thread; pre-flight
  stats probe in get_mbox (mbox returns raw text). list_lists flags
  allow-listed lists; list_restrictions surfaces the policy plus
  current allow-list. Fixes the dead `quick=""` parameter (filtered
  by apiFetch) by sending `quick="1"`.
- restrictions.test.js: 18 unit tests covering pattern grammar,
  allowlist bypass, env-var parsing edge cases, isPrivateBlocked
  truthy/falsy handling, and falsy-input tolerance. `npm test` runs
  with the built-in node:test runner — no new dependencies.
- README: documents the two-layer model, opt-in mechanism, the
  PII / interim ASF policy considerations (with links to the ASF
  Mailing Lists page and Privacy Policy), and Apache Airflow /
  Apache Arrow security@ as opt-in examples.

Generated-by: Claude Code (Claude Opus 4.7)