feat(api): public-safe README status badge

[JSONbored]

Parent roadmap: #525
Parent phase: #528

Background

A README status badge is a low-cost growth/distribution surface that markets Gittensory on every adopting repo — but it is unauthenticated and embeddable, so it is the most exposure-sensitive surface.

Goal

A public-safe GET /v1/public/repos/:owner/:repo/badge.svg (+ a shields badge.json endpoint).

Current Behavior

No badge/shields references exist in src.

Desired Behavior

• Expose a hard-whitelisted metric set only: median time-to-merge, % real (non-slop) contributions, queue-health level.
• Opt-in via a new badgeEnabled setting; only serve for installed repos that opted in. Aggressively cached (reuse the fetchPublicRepoStats TTL + stale-while-revalidate pattern).

Implementation Requirements

• New src/api/badge.ts (self-rendered SVG) + src/services/public-repo-quality.ts deriving only whitelisted metrics from existing snapshots.

Public/Private Output Boundaries

• Unauthenticated: HARD metric whitelist; never contributor-level data or any reward/trust value; routed through the public-safe filter.

Acceptance Criteria

• Badge serves only whitelisted metrics for opted-in repos; cached; no private data path.

Testing Requirements

• npm run test:ci, 97%+ coverage. Whitelist tests + opt-in gating + cache headers + redaction tests.