feat(15-03): serve anonymous GET /_journal/api/v1/posts as a published list

- Public and write groups under /_journal/api/v1 with journal-public-api and journal-api buckets (Max 120)
- Index omits drafts and future published_at; per_page default 9 max 30
- Optional backend JWT on GET; missing Bearer on writes returns PHP {error:Authentication required}

Co-authored-by: Cursor <cursoragent@cursor.com>

plugin.go

@@ -3,23 +3,30 @@ package journal
 import (
 	"embed"
 	"io/fs"
+	"net/http"
+	"strconv"
+	"time"
 
 	"git.golem15.com/golem15/sm-journal-plugin/console"
 	"git.golem15.com/golem15/sm-journal-plugin/models"
 	"git.golem15.com/golem15/sm-journal-plugin/updates"
 	"git.golem15.com/golem15/summercms/modules/backpack"
 	"git.golem15.com/golem15/summercms/modules/bonfire"
+	"git.golem15.com/golem15/summercms/modules/bouncer"
 	"git.golem15.com/golem15/summercms/modules/pact"
 	"git.golem15.com/golem15/summercms/modules/party"
+	"git.golem15.com/golem15/summercms/modules/surf"
 	"github.com/go-gormigrate/gormigrate/v2"
 )
 
 var (
-	_ party.Plugin       = (*Plugin)(nil)
-	_ pact.HasMigrations = (*Plugin)(nil)
-	_ pact.HasModels     = (*Plugin)(nil)
-	_ pact.HasLang       = (*Plugin)(nil)
-	_ pact.HasCommands   = (*Plugin)(nil)
+	_ party.Plugin        = (*Plugin)(nil)
+	_ pact.HasMigrations  = (*Plugin)(nil)
+	_ pact.HasModels      = (*Plugin)(nil)
+	_ pact.HasLang        = (*Plugin)(nil)
+	_ pact.HasCommands    = (*Plugin)(nil)
+	_ pact.HasRoutes      = (*Plugin)(nil)
+	_ surf.BucketProvider = (*Plugin)(nil)
 )
 
 //go:embed lang
@@ -57,6 +64,36 @@ func (p *Plugin) Commands() []bonfire.Command {
 	}
 }
 
+// Buckets registers PHP limiter names journal-public-api and journal-api
+// (D-17). 429 bodies stay surf {"message":"Too Many Attempts."}.
+func (p *Plugin) Buckets() map[string]surf.Bucket {
+	trusted := surf.TrustedProxies(nil)
+	if p.app != nil {
+		trusted = surf.TrustedProxies(p.app.Config)
+	}
+	return map[string]surf.Bucket{
+		"journal-public-api": {
+			Name:  "journal-public-api",
+			Max:   120,
+			Decay: time.Minute,
+			Key: func(r *http.Request) string {
+				return "journal-public|" + surf.ClientIP(r, trusted)
+			},
+		},
+		"journal-api": {
+			Name:  "journal-api",
+			Max:   120,
+			Decay: time.Minute,
+			Key: func(r *http.Request) string {
+				if pr, ok := bouncer.User(r.Context()); ok && pr != nil && pr.Backend {
+					return "journal-api|u:" + strconv.FormatUint(uint64(pr.ID), 10)
+				}
+				return "journal-api|" + surf.ClientIP(r, trusted)
+			},
+		},
+	}
+}
+
 func init() {
 	party.Register(&Plugin{})
 }