feat(profile): show reputation badges and history

[KareemN1936]

Summary

• Add a public profile API at GET /profiles/:username backed by existing users, latest reputation snapshots, contribution drafts, canon lore entries, and app vote history.
• Derive MVP reputation levels/badges from the stored reputation score without changing voting weight or the scoring model.
• Replace the placeholder profile page with a real profile view showing score, badge, contribution history, canon entries, and recent votes.

Trello

• https://trello.com/c/6Fprw569/29-m2-reputation-profile-badges

Verification

• npm test --workspace=@hivelore/api (200 passed, 1 skipped because TEST_DATABASE_ADMIN_URL is not configured locally)
• npm run typecheck --workspace=@hivelore/api
• npm run typecheck --workspace=@hivelore/web
• npm run lint --workspace=@hivelore/api
• npm run lint --workspace=@hivelore/web
• npm run build --workspace=@hivelore/api
• npm run build --workspace=@hivelore/web

[KareemN1936]

Implementation note for Trello card https://trello.com/c/6Fprw569:

This PR builds the profile + badges layer on top of the existing reputation snapshot model rather than changing reputation scoring or voting weight.

Implemented:

• public GET /profiles/:username endpoint;
• latest reputation snapshot serialization with MVP badge levels;
• contribution draft, canon lore entry, and recent vote history;
• real /profile/[username] page replacing the placeholder.

Verified locally:

• npm test --workspace=@hivelore/api (200 passed, 1 skipped because TEST_DATABASE_ADMIN_URL is not configured locally)
• npm run typecheck --workspace=@hivelore/api
• npm run typecheck --workspace=@hivelore/web
• npm run lint --workspace=@hivelore/api
• npm run lint --workspace=@hivelore/web
• npm run build --workspace=@hivelore/api
• npm run build --workspace=@hivelore/web

[github-actions]

Vercel preview is ready:

https://hivelore-bdj31m4u9-kareemn1936s-projects.vercel.app

Commit: 52e0938

[mcfarhat]

Approving with one fix pushed directly to your branch (4fdf70d), since you're the only one on this now and it was small.

The badge work is solid

Tests genuinely bite — I mutated the logic and each of these failed a test: shifting the Canon Keeper threshold above the tested score, swallowing InvalidHiveUsernameError, and changing nextScore. Validation and the 404 path are properly covered.

What I fixed — a privacy leak on a public endpoint

GET /profiles/:username has no auth hook, and the profile query filtered only on the user. Both relations were selected with no status filter:

contributionDrafts: { orderBy: …, select: { title, status, world … }, take: 10 }
loreEntries:        { orderBy: …, select: { title, status, slug  … } }

ContributionStatus is DRAFT | SUBMITTED, so any unauthenticated visitor could read another user's unsubmitted draft titles and which world they were drafting in. Same for non-canon loreEntries (DRAFT, SUBMITTED, APPROVED_FOR_PUBLICATION, ARCHIVED).

Fix:

• contributionDrafts → where: { status: 'SUBMITTED' }
• loreEntries → where: { status: 'PUBLISHED_CANON' }

Why the tests didn't catch it — worth knowing for next time

The stub's findUnique returned the fixture rows regardless of the query, so a missing where could never surface: the mock answered the same whether you filtered or not. The fixture also only contained SUBMITTED/PUBLISHED_CANON rows, so there was nothing private to leak.

I changed the stub to honour the nested where the way Prisma does, and added an unsubmitted draft plus a non-canon lore entry to the fixture, with a test asserting neither appears in the response. Removing either filter now fails two tests — verified by mutation both ways.

That's the general lesson: a mock that ignores the query can only test your assumptions, not your code. When the stub answers identically for every query, absence-of-filter is invisible.

Gates

Quality and Vercel Preview both pass. Full api suite: 20 failures locally both before and after my change — all environmental (no local Postgres), zero regression from the fix.