B2B-1 · Close public leak surfaces (sitemap, search, home, stats)

Part of the B2B epic (Fase 1 · item 1.1a of `Escopo_B2B_Levantamento_Construcao.md`). **This is the pilot blocker**: without it, the sitemap alone publishes private-namespace content to Google.

## What
Ensure no public surface exposes content from non-`main` namespaces.

- [ ] `server/sitemap/sitemap.service.ts:30-64` — global catalog dump, no namespace filter (**worst offender**)
- [ ] `server/search/search.controller.ts:62-71,183-187` — personality search without namespace scoping
- [ ] `server/home/home.controller.ts:79-90` — global personalities/debates on the public home
- [ ] `server/stats/stats.service.ts:26-29` — global counts (indirect-signal leak)

## Notes
- Reuse the existing pattern: `name-space.guard` + `util.ts:49`.
- Indirect signals count as leaks: public counts/aggregates must not reveal that a private check *exists* (commons model — personalities stay global).

**Effort:** ~1 SP · **Depends on:** — · **Blocks:** design-partner pilots

Read the existing name-space.guard pattern and util.ts:49 first, then inspect the listed ranges in server/sitemap/sitemap.service.ts, server/search/search.controller.ts, server/home/home.controller.ts, and server/stats/stats.service.ts. Done means public surfaces no longer expose content or indirect counts from non-main namespaces, while the documented commons model remains global.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.