feat(api): add authenticated user search

[pengyuayn]

What

Adds GET /users/search for authenticated username prefix search.

Why

Issue #471 asks for a protected user-search endpoint so leaderboard/profile UI can find users without exposing private account fields.

How

• Adds /users/search?q=&page= before dynamic user routes.
• Requires auth via authenticate to prevent anonymous enumeration.
• Validates q as at least 2 chars and page as a 1-based integer.
• Uses username ILIKE 'prefix%', LIMIT 20, and offset pagination.
• Returns only whitelisted public fields: id, username, avatar_url, total_earnings.
• Keeps no-match responses as an empty array.
• Focuses the users route test harness on /users so unrelated route parse errors do not block this suite.

Test plan

• ./node_modules/.bin/vitest run apps/api/src/routes/users.test.ts
• ./node_modules/.bin/prettier --check apps/api/src/routes/users.ts apps/api/src/routes/users.test.ts
• git diff --cached --no-color | node scripts/gitleaks.mjs detect --pipe --redact --config .gitleaks.toml --verbose
• ./node_modules/.bin/tsc -p apps/api/tsconfig.json --noEmit currently blocked by existing unrelated apps/api/src/routes/leaderboard.ts(196,1): error TS1128

Closes #471