fix: keep hardcoded visibility for backwards compatibility

[mbevc1]

Restore payload removed in #918 to make it compatible with older Kosli instances.

Recent Kosli servers accept flow create/update without visibility, but older instances might still reject the payload without it. Keep sending visibility: "private" for backwards compatibility, with a comment marking it for removal once the minimum supported server version no longer requires the field.

[claude]

Claude finished @mbevc1's task in 1m 52s —— View job

---

Review of PR #922

• Run static analysis (build, vet, mod tidy)
• Review code changes
• Post review feedback

Static Analysis

All checks pass: go build, go vet, go mod tidy — no issues.

Review Summary

This PR looks good. It's a small, focused backwards-compatibility fix that restores the Visibility field removed in #918.

What's done well:

• The TODO comment on the struct is thorough — it explains why the field exists, when it can be removed, and what to clean up (both the field and the run() assignment). This is exactly the kind of comment worth keeping.
• Setting the value in run() rather than as a struct default keeps the logic in one place and means test helpers don't need to know about it.
• The change is minimal and self-contained.

No issues found with correctness, security, or performance. The existing createFlow tests exercise both the template-file and legacy code paths, and Visibility is unconditionally set in run(), so the field will be present in all requests regardless of which path is taken.