feat(api): /v1/extension/* contributor-context endpoints + miner auth scope

[JSONbored]

Parent roadmap: #525
Parent phase: #527

Background

The browser-extension rebuild (#534) is largely visual. Its non-visual backend — the API the overlay reads and the miner auth scope — is independent, deterministic, and ideal for contributors. This issue carves that out so #534 can focus on rendering.

Goal

Build the /v1/extension/* contributor-context endpoints + the miner auth scope that the rebuilt extension (and any client) consumes.

Current Behavior

The extension session token is maintainer-only (POST /v1/auth/extension/session, routes.ts:750); there are no miner-facing /v1/extension/* contributor endpoints.

Desired Behavior

• Add an extension:contributor_context scope (minted for non-maintainer sign-ins), with a strict self-only path allowlist (/v1/extension/contributors/<self>/*).
• Add redaction-checked endpoints: issue-fit, own-PR preflight + review status, issue-list badges (data shapes the overlay renders). Each payload passes the shared public-safe filter; the score preview is returned as a band, never a number.

Implementation Requirements

• src/api/routes.ts + auth scope plumbing (canSessionAccessPath). No UI. Depends on the shared redaction module (refactor(signals): shared public-safe redaction module #542).

Public/Private Output Boundaries

• A miner token can only read its own contributor data; server-side authoritative redaction.

Acceptance Criteria

• Endpoints return public-safe payloads; miner-scope allowlist is enforced (covered by tests).

Testing Requirements

• npm run test:ci, 97%+ coverage. Scope-allowlist + redaction tests mirroring the existing extension route tests.