#18 · Public JSON endpoint `/api/bounties` for embeddable bounty list

Context

The /bounties page renders HTML server-side; other surfaces (Signal bot, Irregularpedia, community portal) need a JSON shape. Cleanly separate the data-fetcher from the renderer and expose it as a public read-only endpoint.

Acceptance criteria

• [ ] GET /api/bounties returns { issues: BountyIssue[], fetched_at, error }
• [ ] CORS allowlist matches PUBLIC_LEADERBOARD_ORIGINS (irregularpedia.org, irregulars.io, etc.)
• [ ] Cache headers set so browsers/edge cache for 60s
• [ ] Filtering: ?app=signal-bot, ?tier=m, ?unclaimed=1 query params

Technical hints

• Already-built fetchBounties(env) in apps/scoreboard/src/api/bounties.ts is the data source
• Mirror the CORS pattern from apps/scoreboard/src/index.ts /api/leaderboard route

--- *Submit a merge request that says Closes #<this issue iid> in the description. On merge to main, the GitLab webhook will auto-award your bounty + the standard merge_pr (40 pts) to your scoreboard account. Email on commit must match your Authentik email.*