feat(17-04): public FAQ API with output sanitizing, throttle bucket and README

- GET /_faq/api/v1/faqs/{slug}?locale=xx, anonymous, faq-public-api bucket (120/min per client IP)
- locale by enabled code or the default locale; active row, lowest id among duplicates
- description and answers passed through seaglass.Sanitize on output; 404 {"error":"FAQ not found"}
- TestFaqAPISmoke; README with API, CORS paths, import workflow and Winter adaptations
- go mod tidy records the test dependencies

plugin.go

@@ -4,6 +4,9 @@
 package faq
 
 import (
+	"net/http"
+	"time"
+
 	"git.golem15.com/golem15/sm-faq-plugin/console"
 	"git.golem15.com/golem15/sm-faq-plugin/models"
 	"git.golem15.com/golem15/sm-faq-plugin/updates"
@@ -11,14 +14,17 @@ import (
 	"git.golem15.com/golem15/summercms/modules/bonfire"
 	"git.golem15.com/golem15/summercms/modules/pact"
 	"git.golem15.com/golem15/summercms/modules/party"
+	"git.golem15.com/golem15/summercms/modules/surf"
 	"github.com/go-gormigrate/gormigrate/v2"
 )
 
 var (
-	_ party.Plugin       = (*Plugin)(nil)
-	_ pact.HasMigrations = (*Plugin)(nil)
-	_ pact.HasModels     = (*Plugin)(nil)
-	_ pact.HasCommands   = (*Plugin)(nil)
+	_ party.Plugin        = (*Plugin)(nil)
+	_ pact.HasMigrations  = (*Plugin)(nil)
+	_ pact.HasModels      = (*Plugin)(nil)
+	_ pact.HasCommands    = (*Plugin)(nil)
+	_ pact.HasRoutes      = (*Plugin)(nil)
+	_ surf.BucketProvider = (*Plugin)(nil)
 )
 
 // Plugin is the golem15.faq plugin.
@@ -50,6 +56,26 @@ func (p *Plugin) Migrations() []*gormigrate.Migration { return updates.All() }
 
 func (p *Plugin) Models() []any { return models.All() }
 
+// Buckets registers faq-public-api: 120 requests a minute per client IP
+// (behind the configured trusted proxies). 429 bodies are surf's
+// {"message":"Too Many Attempts."}.
+func (p *Plugin) Buckets() map[string]surf.Bucket {
+	trusted := surf.TrustedProxies(nil)
+	if p.app != nil {
+		trusted = surf.TrustedProxies(p.app.Config)
+	}
+	return map[string]surf.Bucket{
+		"faq-public-api": {
+			Name:  BucketPublicAPI,
+			Max:   120,
+			Decay: time.Minute,
+			Key: func(r *http.Request) string {
+				return "faq-public|" + surf.ClientIP(r, trusted)
+			},
+		},
+	}
+}
+
 func init() {
 	party.Register(&Plugin{})
 }