feat(api): enrich badges endpoint

[lukevio]

What

Adds the richer GET /badges response requested by #466.

Why

The badge UI needs a canonical public badge list with unlock metadata, plus optional per-user earned state when a valid token is supplied.

How

• Builds public badge definitions from the existing badge service metadata.
• Adds category and unlockCriteria to each badge.
• Supports ?category= filtering.
• Uses optional auth so anonymous callers still receive the public list.
• Adds earned and earnedAt only for authenticated callers.
• Sends Cache-Control: public, max-age=300 only for anonymous responses.
• Keeps empty badge lists as 200 { badges: [] }.
• Updates route tests to cover anonymous, authenticated, category-filter, empty-list, and admin flush behavior.

Test plan

• ./node_modules/.bin/vitest run apps/api/src/routes/badges.cache.test.ts
• ./node_modules/.bin/vitest run apps/api/src/routes/badges.cache.test.ts apps/api/src/services/badges.test.ts
• ./node_modules/.bin/prettier --check apps/api/src/routes/badges.ts apps/api/src/routes/badges.cache.test.ts
• git diff --cached --no-color | node scripts/gitleaks.mjs detect --pipe --redact --config .gitleaks.toml --verbose
• ./node_modules/.bin/tsc -p apps/api/tsconfig.json --noEmit currently blocked by existing unrelated apps/api/src/routes/leaderboard.ts(196,1): error TS1128

Note: the local Husky pre-commit hook invokes pnpm gitleaks:pre-commit, but pnpm currently exits before running the script due ignored build-script approvals for @fingerprintjs/fingerprintjs-pro-react and @sentry/cli. I ran the underlying staged-diff gitleaks command directly and it passed.

Closes #466