RSVP guest_count and note should be public, not host-only

## Bug The RSVP list endpoint (OP#4165) strips guest_count and note from non-host callers via _strip_private_fields() in rsvp_service.py. These fields should be public. ## Why guest_count should be public - The aggregate total_guests is already public via rsvp_counts on the event detail - Hiding per-person guest_count while showing the aggregate protects nothing - Frontend needs it to show '+2 guests' badges on attendee avatars - It is useful social information (knowing how many people are actually coming) ## Why note should be public - Notes are messages like 'Looking forward to it!' — social content, not private - Other attendees seeing notes creates community engagement - If someone wants a private message to the host, that should be a separate DM feature ## What SHOULD stay private (host-only) - source: tracking/analytics data (how the RSVP was sourced) - checked_in_at: operational data for attendance management ## Fix In _strip_private_fields() in rsvp_service.py, remove guest_count and note from the stripped fields. Only strip source and checked_in_at for non-host callers. ## Found by Frontend development — attendee avatar badges need guest_count