feat(api): add public demo scenario manifest endpoint

[OG-wura]

Close #80

PR description:

Summary

Adds a public read-only endpoint GET /api/scenarios that returns the canonical demo scenarios supported by the app. This helps reviewers and demo runners reproduce the exact demo path without needing internal documentation.

Changes

• packages/shared/src/schemas.ts — Added demoScenarioSchema and demoScenarioManifestSchema Zod schemas
• packages/shared/src/types.ts — Added DemoScenario and DemoScenarioManifest interfaces
• apps/api/src/routes/public.ts — Added GET /api/scenarios endpoint returning 3 scenarios (one per mode) with stable hardcoded manifest data
• apps/web/src/lib/api.ts — Added fetchDemoScenarios() helper for optional web integration
• apps/api/src/routes/public.test.ts — 5 tests covering response shape, all three modes, stability on repeated calls, and confirming no provider execution occurs

Manifest contents

{
  "scenarios": [
    {
      "id": "search-provider-comparison",
      "mode": "search",
      "recommendedProvider": "search.basic",
      "sampleQuery": "latest stellar x402 updates",
      "expectedEvidenceFields": ["providerId","providerName","priceUsd","latencyMs","timestamp","traceId","items","source","execution"],
      "worksInDemoMode": true,
      "worksInRealMode": true
    },
    {
      "id": "news-payment-flow",
      "mode": "news",
      "recommendedProvider": "news.fast",
      "sampleQuery": "stablecoin micropayments",
      "expectedEvidenceFields": ["providerId","providerName","priceUsd","latencyMs","timestamp","traceId","items","source","execution"],
      "worksInDemoMode": true,
      "worksInRealMode": true
    },
    {
      "id": "scrape-result-display",
      "mode": "scrape",
      "recommendedProvider": "scrape.page",
      "sampleQuery": "https://developers.stellar.org",
      "expectedEvidenceFields": ["providerId","providerName","priceUsd","latencyMs","timestamp","traceId","items","source","execution"],
      "worksInDemoMode": true,
      "worksInRealMode": true
    }
  ]
}
Verification
- Endpoint returns JSON without requiring payment or credentials
- No provider execution occurs when fetching the manifest
- All 5 new tests pass
- All existing passing tests continue to pass

[vercel]

@OG-wura is attempting to deploy a commit to the emrekayat's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@OG-wura Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[emrekayat]

Thanks for the PR. I rechecked the merge ref from the maintainer account. The functional checks pass:

git diff --check main...pr-101-merge
npm run test --workspace @query402/shared
npm run test --workspace @query402/api -- src/routes/public.test.ts
npm run typecheck --workspace @query402/api
npm run typecheck --workspace @query402/web

Results: shared tests pass (12), public route tests pass (17), API typecheck passes, and web typecheck passes.

I cannot merge this exact PR yet because package-lock.json has large unrelated churn: thousands of dependency metadata/version/resolved/integrity changes, while this endpoint does not appear to require dependency changes. Please revert the lockfile noise and keep the diff focused on the manifest endpoint, shared schema/types, API test, and optional web API helper. After that this should be ready if the same checks stay green.

[OG-wura]

done