Fix visibility rules matching and test 101

- Core: Remove 'userName' check to fix false negatives in API match.
- Core: Add 'updatedAt' tiebreaker to prioritize newer rules.
- Tests: Pass 'userName' as string in test 101 to fix 400 Bad Request.