api(bounties): aggregates ignore repo visibility, exposing private-repo activity

[euxaristia]

Summary

bounty_stats and agent_bounty_stats (crates/gitlawb-node/src/api/bounties.rs:460-502) run unfiltered aggregates over all bounties (crates/gitlawb-node/src/db/mod.rs:4530-4565) with no repo-read gating. The sibling stats endpoint was deliberately scoped to anonymously listable repos (#104, server.rs:546-570), and row-level bounty routes are visibility-gated; these two aggregates were not updated.

Impact

An anonymous caller can infer private-repo bounty activity from aggregate deltas and read per-agent earnings totals. No repo identity is disclosed; aggregate-granularity signal only.

Remediation

1. Restrict both aggregates to anonymously readable repos (mirror Unauthenticated GET /api/v1/stats leaks the count of private/mode-A repos (count oracle) #104) or gate the routes.

Proposed labels: kind:security, crate:node, subsystem:api.

[beardthelion]

Recalibrating to sev:medium. The leak is aggregate-granularity: deltas over all-bounty stats with no repo identity disclosed. That is weaker than #341 (medium), where a stranger could distinguish a specific private-repo bounty from a nonexistent one. A fix is already open at #483.

[Mystic-commits]

I've opened PR #495 to resolve this.

Approach & Differentiators:

• Zero N+1 DB Queries / No Table Walks: Mirrors the canonical stats() pattern (Unauthenticated GET /api/v1/stats leaks the count of private/mode-A repos (count oracle) #104, server.rs:546-570) by batch-loading repos and visibility rules once, evaluating listable_at_root in memory, and performing aggregation in PostgreSQL via unnest.
• Fails Closed: Database errors collapse the visible set to empty, returning 0/empty without leaking private repo existence.
• Includes Deny-Probe Tests: Added integration tests in crates/gitlawb-node/src/test_support.rs verifying anonymous probes cannot observe private repo bounties in global stats, leaderboard, or per-agent earnings.

PR: #495