feat(profile): public profile data for a ticket from Auth

GET /api/public/profiles/library with X-Profile-Ticket returns totals, status
counts, playing and finished games with rating; never notes, priority or the
Steam ID. Login filters reject the ticket, and Core keeps no copy of the
privacy flag.

readme.md

@@ -164,6 +164,6 @@ Today `user_game` mirrors Steam ownership and playtime, nothing else. Closing th
 - Series / franchise grouping: needs IGDB integration (separate adapter, requires a free IGDB OAuth token).
 - **Multi-platform support**: bigger schema change. Decouple `Game` (platform-agnostic) from `SteamGame` (platform-specific). New `source` enum (`STEAM`, `GOG`, `EPIC`, `MANUAL`, ...). Defer until at least one non-Steam adapter is on the immediate horizon.
 
-### 8. Public profile data
+### 8. ~~Public profile data~~ Done
 
-- Endpoint: `GET /api/public/users/{username}/profile` returning currently-playing + recently-completed + total hours, gated by a `profile_public` flag (owned by Auth, mirrored or fetched on demand).
+- `GET /api/public/profiles/library` with header `X-Profile-Ticket` (issued by Auth for a public profile, valid 10 minutes, see the Auth readme) returns totals, status counts, up to 8 playing and 12 finished games with rating. Never notes, priority or the Steam ID. Core keeps no copy of the privacy flag; the ticket is the proof.