Public API / REST endpoint for leaderboard data

Description

A public REST API lets the community website, bots, and third-party integrations query leaderboard and player stats without accessing the database directly. This enables a community ecosystem around the game at release.

Acceptance Criteria

• GET /api/v1/leaderboard/{cupName} returns top 10 entries as JSON (position, playerName, score, date)
• GET /api/v1/player/{uuid}/stats returns a player's total races, wins, PBs per map
• GET /api/v1/cups returns the list of available cups with map count and ring count
• API is read-only (no write endpoints in v1)
• Rate limited to 60 requests/minute per IP
• Responses are cached for 30 seconds (configurable)
• API served on a separate port (default: 8080) from the game server (25565)
• OpenAPI/Swagger spec document generated and committed to docs/api/

Technical Details

• Embed a lightweight HTTP server (Javalin or Jooby) in the server module for the API
• Add javalin or jooby to the version catalog
• API reads from the same DB as the game server (read-only connection pool)
• Authentication is out of scope for v1

Dependencies

• "Persistent leaderboard" and "Personal best tracking" (Beta) must be complete first

Estimate

L

Start by inspecting the server module, version catalog, and the status of the Persistent leaderboard and Personal best tracking dependencies. Then map the read-only database access and the API's separate-port configuration before reviewing the required endpoints, rate limiting, and caching. Done means the three endpoints, OpenAPI spec in docs/api/, and all listed operational constraints are implemented.