chore: ensure local package private

[bluwy]

Description

Ensure local packages have "private": true to prevent accidental publish. Also set for create-vite templates.

Additional context

There are two package.json in packages/vite/src/node/__tests__/packages that I didn't update since it could affect the tests, but the package.json themselves are already invalid so it prevents publishing.

---

What is the purpose of this pull request?

• Bug fix
• New Feature
• Documentation update
• Other

Before submitting the PR, please make sure you do the following

• Read the Contributing Guidelines.
• Read the Pull Request Guidelines and follow the Commit Convention.
• Check that there isn't already a PR that solves the problem the same way to avoid creating a duplicate.
• Provide a description in this PR that addresses what the PR is solving, or reference the issue that it solves (e.g. fixes #123).
• Ideally, include relevant tests that fail without this PR but pass with it.

[patak-cat]

@bluwy LGTM, as the package.json is regenerated in create_vite. The templates are also used as is in StackBlitz, and there the private: true may not be the best as the user will need to remove it later but this is safer on Vite's side.

[bluwy]

👍 I think it will be safer for the user too so they don't accidentally publish their project to npm, even if it's with lib mode. In the past when setting up changesets, the default template without private: true has caught us a few times accidentally publishing them.

[patak-cat]

You are right. We should add private: true to create vite apps by default then