feat(api/v2): ✨ Implement showcase routes - #78

Nice!

I think your currently missing showcase.approved in the DTOs of the GET routes. The images might also need hash and checked

Picked this up and finished the two TODOs. Rebased onto the current api/v2 first — the branch was 5 commits behind and conflicted in app.module.ts.

Image upload — v2 had no way to store one, so the create route could never work:

• common/db/external/s3.service.ts, a thin wrapper over the same CDN bucket v1 writes to. Missing credentials log a warning and fail calls with 503 instead of taking the app down.
• common/uploads/uploads.service.ts validates type/size/readability, stores the object, records the Upload row, and rolls the object back if the row write fails.
• The blur hash is plaiceholder's base64 pipeline reimplemented on sharp — plaiceholder v3 is ESM-only and api-v2 compiles to CommonJS. Recorded width/height are the real dimensions; v1 stores a fixed 1920x1080 that falls out of its resize call.

Authorization — reads stay public (showcases are what the landing page renders), writes go through TeamScope, so every route now exists both bare and behind :teamId as the roadmap asks. approved is readable and filterable but deliberately not updatable: a team should not be able to approve itself onto the front page.

Also fixed two things in the draft: ShowcasesService was never listed in the module's providers (it would not have booted), and POST now accepts either a multipart image or an existing uploadId, matching v1's create/link split.

One known gap, deliberately left in: Upload rows are not team-scoped in the schema, so a team can pass another team's uploadId and attach its image to their own showcase. v1 has the same hole in its link route. Closing it needs a schema change (an owner column on Upload, or a join through the showcase/claim that created it), which felt out of scope here.

Verified: 160 tests pass (34 new, including a supertest pass over the real router for the public/scoped split), tsc --noEmit clean, build clean, lint clean apart from the 6 pre-existing unbound-method errors.

@Nudelsuppe42 caught up on your review from January:

• approved is now on ShowcaseDto, and it is filterable and sortable on both GET routes. It is not accepted on PUT though — a team approving its own showcases onto the front page seemed like the wrong default, so that stays a v1/admin action for now. Happy to add it if you'd rather have it here.
• hash and checked are both on the image DTO now, along with width, height and createdAt.

While adding checked I swapped include: { image: true } for an explicit column select, so the response and ShowcaseImageDto are the same shape and the docs cannot drift from what callers actually get. That also drops claimId, which was being returned incidentally.

PR description is rewritten and the branch is rebased on current api/v2.