feat(15-03): serve anonymous GET /_journal/api/v1/posts as a published list

- Public and write groups under /_journal/api/v1 with journal-public-api and journal-api buckets (Max 120)
- Index omits drafts and future published_at; per_page default 9 max 30
- Optional backend JWT on GET; missing Bearer on writes returns PHP {error:Authentication required}

Co-authored-by: Cursor <cursoragent@cursor.com>

plugin_test.go

@@ -3,6 +3,7 @@ package journal
 import (
 	"strings"
 	"testing"
+	"time"
 
 	"git.golem15.com/golem15/summercms/modules/pact"
 )
@@ -52,3 +53,23 @@ func TestJournalCommands(t *testing.T) {
 		t.Fatalf("Posts AdminActions missing import/export with access_import_export (export=%v import=%v)", foundExport, foundImport)
 	}
 }
+
+func TestJournalBuckets(t *testing.T) {
+	p := &Plugin{}
+	buckets := p.Buckets()
+	for _, name := range []string{"journal-public-api", "journal-api"} {
+		b, ok := buckets[name]
+		if !ok {
+			t.Fatalf("Buckets() missing %s", name)
+		}
+		if b.Max != 120 {
+			t.Fatalf("%s Max = %d, want 120", name, b.Max)
+		}
+		if b.Decay != time.Minute {
+			t.Fatalf("%s Decay = %s, want 1m", name, b.Decay)
+		}
+		if b.Key == nil {
+			t.Fatalf("%s Key is nil", name)
+		}
+	}
+}