Per-install public access toggle

Whether an app allows anonymous visitors is now a per-install setting controlled by the workspace, not a property baked into the app. The same app can be public in one workspace and private in another.