[WPB-23995] fix app access in search, fetch.

[fisx]

Checklist

• Add a new entry in an appropriate subdirectory of changelog.d
• Read and follow the PR guidelines

[Copilot]

Pull request overview

This PR tightens app user visibility so that apps are only discoverable within their own team, affecting contact search as well as app/user fetch paths in Brig and the UserSubsystem.

Changes:

• Introduces team-aware app filtering via new UserProfileFilter variants and applies it across local profile fetch paths.
• Updates contact search (ElasticSearch query) to exclude app users from other teams (or all apps when the searcher has no team).
• Adjusts public and federation endpoints plus integration/unit tests and adds a changelog entry.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
services/brig/src/Brig/API/Public.hs	Enforces same-team access for getApp and filters getApps by team.
services/brig/src/Brig/API/Federation.hs	Ensures federated fetch/search paths do not return apps by default (Nothing team).
libs/wire-subsystems/src/Wire/UserSubsystem.hs	Reworks UserProfileFilter and makes local profile fetch APIs team-aware for app visibility.
libs/wire-subsystems/src/Wire/UserSubsystem/Interpreter.hs	Selects profile filter based on requester’s team and re-filters after app-info injection.
libs/wire-subsystems/src/Wire/IndexedUserStore/ElasticSearch.hs	Excludes apps from other teams in /search/contacts ES query.
libs/wire-subsystems/src/Wire/UserGroupSubsystem/Interpreter.hs	Adapts to new getLocalUserProfiles signature with team context.
libs/wire-subsystems/src/Wire/StoredUser.hs	Custom Arbitrary instance to avoid generating bots/service users in tests.
libs/wire-subsystems/test/unit/Wire/UserSubsystem/InterpreterSpec.hs	Updates unit test call sites for new getLocalUserProfiles signature.
libs/wire-subsystems/test/unit/Wire/MockInterpreters/UserSubsystem.hs	Extends mock interpreter to support the expanded UserProfileFilter.
integration/test/Test/Search.hs	Simplifies federated search test expectations (but reduces type-filter coverage).
integration/test/Test/Apps.hs	Updates app tests to assert cross-team/teardless access restrictions + search visibility.
changelog.d/3-bug-fixes/WPB-23995-app-visibility-2	Documents the behavior change for app visibility.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.