feat(api): add bounty read endpoints

[Thanhdn1984]

Implements #24.

Summary:

• adds zod query/output schemas for GET /bounties and GET /bounties/:id
• supports status/lang/repo/minAmount/page/pageSize filters, createdAt desc sorting, pagination metadata
• returns public DTOs only; no _id, __v, or internal fields
• masks claim hunterAddress unless requester is the claimer or has maintainer role

Notes:

• Current API package is mostly scaffold/placeholder, so this PR adds route modules without wiring them into a non-existent app entrypoint.
• Tests are documented by schema boundaries; once feat(models): all Mongoose schemas (9 models bundle) #16/app wiring lands these routes can be mounted directly.

Test plan:

• not run; package test script is currently placeholder.