Badges / roles on profiles (#167 Phase 3)

[dmccoystephenson]

Summary

Phase 3 of #167. Award badges / roles to users — e.g. contributor, server owner, early adopter, plugin author — and display them on profiles.

Scope

• Backend (dpc-api): a Badge enum/table + a UserBadge join (FK to the local User mirror, awarded-at timestamp). Some badges are derivable and can be computed rather than stored at first: server owner = the user owns at least one API key (ApiKeyRepository.findByOwner), early adopter = User.createdAt before a cutoff. Others (contributor, plugin author) are assigned and need an admin grant path: authenticated admin-only POST/DELETE /api/v1/users/{username}/badges.
• Public exposure: include the badge list on PublicProfileResponse (Public profile pages — view another user's profile (#167 Phase 3) #181) so badges show without auth.
• Frontend: render badges as MUI Chips on the public profile (pages/u/[username].tsx) and the account page.

Why it matters

Badges give recognition (motivating contribution) and let visitors quickly gauge who is behind a review or plugin (a plugin author badge carries weight on that plugin's reviews).

Dependencies

• Displays on public profiles (Public profile pages — view another user's profile (#167 Phase 3) #181).
• The admin-grant path shares an admin-role notion with reviews moderation; deriving server owner / early adopter first keeps an initial cut shippable without an admin system.

Filed as a Phase 3 decomposition of #167; drafted by Claude on behalf of Daniel Stephenson. Claims verified against User, ApiKey/ApiKeyRepository, and the #181 public-profile surface.

[dmccoystephenson]

First cut shipped in PR #197 (merged to `develop`): the badge mechanism plus the first fully-derivable badge, Server Owner (awarded to any user who owns at least one API key). Badges are computed from existing state (not stored) and shown on the public profile (/u/{username}).

Leaving this issue open for the remainder:

• Assigned badges (contributor, plugin author) — need an admin-grant path, which shares an admin-role notion with reviews moderation (Plugin reviews + ratings, with moderation (#167 Phase 3) #192).
• Further derived badges (e.g. early adopter) — needs a configurable join-date cutoff (deliberately not invented here).
• Optionally surface badges on the authenticated Account page too (currently public-profile only).

Update by Claude during an automated dev-loop pass; drafted by Claude on behalf of Daniel Stephenson.