feat(api): add public user profile endpoint

[lukevio]

What

Adds public GET /users/:username/public for #455.

Why

Profile pages need a safe public endpoint that returns player stats, league data, and recent badges without exposing private account data.

How

• Adds an unauthenticated public profile route under users.ts.
• Filters to active, non-deleted users and returns 404 for missing, deactivated, or GDPR-erased accounts.
• Returns username, avatar_url, joined_at, win_count, total_sessions_played, and accuracy_pct.
• Adds latest league data as { tier, rank, season }.
• Adds the 6 most recent awarded badges.
• Manually maps the response to exclude private fields such as email, phone, wallet/KYC data.
• Adds focused Vitest coverage for PII exclusion, active/non-deleted query filters, and 404 behavior.

Test plan

• ./node_modules/.bin/vitest run apps/api/src/routes/users.public.test.ts
• ./node_modules/.bin/prettier --check apps/api/src/routes/users.ts apps/api/src/routes/users.public.test.ts
• git diff --cached --no-color | node scripts/gitleaks.mjs detect --pipe --redact --config .gitleaks.toml --verbose
• ./node_modules/.bin/vitest run apps/api/src/routes/users.test.ts is currently blocked by existing unrelated full-route mock drift: @brandblitz/stellar mock lacks MIN_POOL_STROOPS while importing routes/index.ts.
• ./node_modules/.bin/tsc -p apps/api/tsconfig.json --noEmit currently blocked by existing unrelated apps/api/src/routes/leaderboard.ts(196,1): error TS1128.

Note: the local Husky hook invokes pnpm gitleaks:pre-commit, but pnpm exits first due ignored build-script approvals for @fingerprintjs/fingerprintjs-pro-react and @sentry/cli. I ran the underlying staged-diff gitleaks command directly and it passed.

Closes #455