feat: add /api/leaderboard/token-metadata proxy route to remove client-direct Tenero calls

[whoabuddy]

Problem

app/leaderboard/LeaderboardClient.tsx:77,166 calls Tenero directly from the browser:

const TENERO_API_BASE = \"https://api.tenero.io/v1/stacks\";
// ...
fetch(\`\${TENERO_API_BASE}/tokens/\${addr}\`)

No `X-Api-Key` header → hits Tenero's unauthenticated public tier (100 req/min, 50k/month, shared IP). This is the client-side leak my colleague flagged: the broader server-side migration is in place (`lib/external/tenero-fetch.ts` + scheduler KV cache) but this last component still bypasses it.

Comment at `app/leaderboard/page.tsx:166-169` explicitly acknowledges "client calls Tenero directly per distinct token id" — this route was never built.

Proposal

Add a Next.js route handler:

```
GET /api/leaderboard/token-metadata?tokenIds=,,...
```

• Reads from KV cache first (`tenero:price:{tokenId}`, populated by SchedulerDO once platform: SchedulerDO Tenero refresh task not populating KV (root cause behind #792/#793 leaderboard workaround) #794 is fixed)
• On KV miss, calls `teneroFetch(...)` with `TENERO_API_KEY` server-side
• Returns `{ [tokenId]: { price_usd: number, decimals: number, fetchedAt: number } }`
• Edge-cached `s-maxage=60, stale-while-revalidate=300` (matches scheduler cadence)
• Rate-limited via `RATE_LIMIT_READ`

`LeaderboardClient.tsx` then calls this single endpoint for all distinct token IDs instead of N direct Tenero calls.

Acceptance

• New route returns the same shape the client currently constructs
• `LeaderboardClient.tsx` no longer references `api.tenero.io` directly
• localStorage cache (5-min TTL) preserved as second-tier fallback for offline / soft-failure
• Works while platform: SchedulerDO Tenero refresh task not populating KV (root cause behind #792/#793 leaderboard workaround) #794 is still in-flight (KV miss → server fetch with API key, not 404)

Related

• platform: SchedulerDO Tenero refresh task not populating KV (root cause behind #792/#793 leaderboard workaround) #794 / [new issue]: TENERO_REFRESH_ENABLED off in production
• leaderboard: move Volume + Unrealized P&L compute to server-side (blocked by #809 scheduler + sBTC fixes) #811 leaderboard: move Volume + Unrealized P&L compute to server-side