feat(api): activate the ads public API scope

[realcodesiman]

Summary

• The ads workspace-token scope shipped in the enum/registry/i18n from day one but had no endpoints wired to it — a token scoped to ["ads"] reached nothing.
• Adds public API routes for ads conversion-rule CRUD, CTWA/CTM/CTID funnel and CAPI-delivery reads, conversion export, ad-account reads, and the full messaging-ad campaign lifecycle (create/retry/publish/pause/delete + video upload).
• Every handler calls the same packages/business service method its private/UI counterpart already calls, per .agents/rules/data-access.md.

Changes

• apps/builder/src/features/ads/api/public.ts + schema/public.ts — conversion rules, funnel, CAPI delivery, export, ad-account reads
• apps/builder/src/features/ads-campaign/api/public.ts + schema/public.ts — messaging-ad campaign lifecycle
• apps/builder/src/routers/public.ts — mounts ads on the public router
• packages/business/src/ads-conversion/service.ts — adds findOrFail (single-rule read with the standard not-found contract, reused by the new GET /v1/ads/conversion-rules/{id} handler)
• docs/developer/workspace-api-tokens.md — endpoint-to-scope table and the two invariants specific to this scope (no assertWorkspaceSuperAdmin on the token path; createdBy always null for token-created campaigns)
• Tests: ads-public-scope.test.ts (router wiring), ads-public-api.test.ts, ads-campaign-public-api.test.ts (handler behavior, including the missing-session-user regression guard), plus ads-conversion-rule.service.test.ts coverage for findOrFail

Test plan

• pnpm lint
• pnpm --filter builder check-types
• pnpm --filter @chatbotx.io/business check-types
• pnpm --filter builder test (full suite, 3355 passed)
• pnpm --filter @chatbotx.io/business test (full suite, 2145 passed)