fix: default github export to private and stop blind-pushing on 422 (issue #1872)

[ionfwsrijan]

Problem

POST /project/<id>/export_github created a public GitHub repository with no visibility prompt: the repo payload hard-coded "private": False, so clicking "Export to GitHub" exposed the starter code publicly with no consent. Additionally, on a 422 from repo creation (name already exists) the route silently proceeded to push the file into that existing repository, which could modify a repo the user did not intend to touch.

Fix

• Default to private, opt in to public: the export form on project.html now includes a visibility selector (Private is pre-selected), and the route reads visibility from the form, defaulting to private for any missing/invalid value. The GitHub repo payload sets "private" accordingly, so a repo is never public unless the user explicitly chooses Public.
• No blind-push on 422: when repo creation returns 422 (repository already exists), the route now flashes a clear error and redirects back to the project page instead of pushing the file into an existing repo. PUT is never issued in that case.

Files changed

• src/routes/main_routes.py — read and validate visibility (default private); pass it into the repo payload; return a clear error on 422 instead of continuing.
• src/templates/project.html — visibility selector (Private default / Public opt-in) in the export form.
• tests/test_basic.py — updated the 422 test to assert no blind-push; added tests that export defaults to a private repo and that a repo is only public when explicitly selected.

Testing

• Route simulation confirmed: no visibility choice → private: True; visibility=public → private: False; 422 → redirects back to the project with PUT never called.
• py_compile passes on all modified files.

Closes #1872

[vercel]

@ionfwsrijan is attempting to deploy a commit to the komalsony234-1530's projects Team on Vercel.

A member of the Team first needs to authorize it.