fix: filter thread metadata before sending it to the client

[ayylemao]

Closes #3052

Problem

Thread retrieval, listings, and resume events sent all stored thread metadata to the client, including backend-specific values the frontend does not use. Shared threads removed a few known fields but still exposed arbitrary custom metadata.

Changes

Filter metadata at these response boundaries to include only fields used by the frontend:

• is_shared and viewer_read_only
• chat_profile and chat_settings when retrieving or resuming an owner's thread

The stored metadata remains unchanged and fully available to the backend. Custom metadata fields are no longer included in client responses.

---

Summary by cubic

Filters thread metadata sent to the client so backend-specific and custom fields are no longer exposed, closing #3052.

Previously, thread retrieval, listings, and resume events sent the full stored metadata to the browser. Now only the frontend fields is_shared and viewer_read_only (plus chat_profile and chat_settings for an owner's thread) are included in responses. Stored metadata remains unchanged and fully available to the backend.

^{Written for commit bcbd925. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}