fix: a private account is private in the account manager too

[blaipr]

AccountFilter::buildFilter() puts the private rule outside the block the admin flags
skip, so it holds for isAdminApp and isAdminAcc alike: a private account is its
owner's, a private-group account its group's, and nothing else in the application shows
it to anybody else. AccountAcl agrees, checking isWithheldAsPrivate() before the admin
bypass. The account manager's grid applied neither, because it applies no filter at all —
Account::search() selects from the search view with nothing but the LIKE for the search
box.

So the one screen in the application where a private account was visible to somebody who
is not its owner was the manager, which listed its name, client, category and owning user
to any holder of mgmAccounts.

That the grid is unscoped by ownership is deliberate and already recorded — #748 wrote
it down precisely so a later change scoping it would be a decision rather than an
accident, and there is a test holding it. This does not touch that. It applies the private
rule and only the private rule, so an account that is merely somebody else's is still
listed exactly as before, and the test that pins that still passes.

The rule now has one definition rather than two. buildFilterPrivate() is what
buildFilter() ends with, and what the manager's query asks for on its own — with a
column prefix, because the manager reads a view where the account's columns are
unqualified.

Two tests, both against a real database in the file that already switches who is signed
in: a stranger holding the manager permission does not see the private account but does
still see the non-private one, and the owner still sees their own. Without that second
assertion a fix that hid everything would satisfy the first, and without the third the
rule would have become "nobody manages a private account" rather than "only its owner
does".

Checked by removing the filter: the first test fails.