fix(apps): harden public app endpoints against disclosure, DoS, view tampering

- Whitelist public listing + detail responses via toPublicAppListItem/toPublicAppDetail (drops originalPrompt/finalPrompt/sessionToken/userId/deploymentId/parentAppId; private-repo GitHub URLs owner-only)
- Keep prompt + code visible on public apps (intended feature); owner still receives userId/deploymentId
- Bound page/search + query timeout + dedicated publicApps rate limit
- Deduplicate views via viewerHash (unique index + upsert + COUNT DISTINCT) with backfill migration
- Add regression tests for DTO deny-list and request-shape validation

Author: karishnu

migrations/0006_puzzling_bloodstrike.sql

@@ -0,0 +1,6 @@
+ALTER TABLE `app_views` ADD `viewer_hash` text;--> statement-breakpoint
+-- Backfill existing rows with their unique id so historical view counts are
+-- preserved under COUNT(DISTINCT viewer_hash) and the unique index below is
+-- satisfied. Going-forward dedup uses a per-viewer/per-bucket hash on insert.
+UPDATE `app_views` SET `viewer_hash` = `id` WHERE `viewer_hash` IS NULL;--> statement-breakpoint
+CREATE UNIQUE INDEX `app_views_app_viewer_idx` ON `app_views` (`app_id`,`viewer_hash`);