fix(org): handle anonymous users in repo count filtering

Set Private flag based on whether actor is present. When actor is nil (anonymous), Private must be false so SearchRepositoryCondition correctly filters to public repos only. Fixes repo count visibility for unauthenticated users.

routers/api/v2/mcp.go

@@ -2198,7 +2198,7 @@ func toolListRepos(ctx *context_service.APIContext, args map[string]any) (any, e
 		},
 		Actor:    ctx.Doer,
 		OwnerID:  ownerUser.ID,
-		Private:  true,
+		Private:  ctx.Doer != nil,
 		OrderBy:  db.SearchOrderByAlphabetically,
 		Archived: optional.Some(false),
 	})

services/org/pinned.go

@@ -62,11 +62,13 @@ func GetOrgOverviewStats(ctx context.Context, orgID int64, actor *user_model.Use
 	stats.TotalMembers = memberCount
 	stats.TotalTeams = teamCount
 
-	// Repo count - use SearchRepository with Actor for permission filtering
+	// Repo count - use SearchRepository with Actor for permission filtering.
+	// Private=true only works when Actor is set; for anonymous users we must
+	// use Private=false so SearchRepositoryCondition filters to public repos only.
 	_, stats.TotalRepos, err = repo_model.SearchRepository(ctx, repo_model.SearchRepoOptions{
 		Actor:   actor,
 		OwnerID: orgID,
-		Private: true,
+		Private: actor != nil,
 	})
 	if err != nil {
 		return nil, err