feat(17-04): public menu API with registry resolution, throttle bucket and README

- GET /_menu/api/v1/menus/{code}?locale=xx, anonymous, menu-public-api bucket (120/min per client IP)
- classes.BuildTree: published entries nested by parent, sort_order then id, scheme-checked URLs
- registry entries resolved through signpost with url_pattern as the item override and the locale's alternate
- list types keep stored URL and title, generated children follow stored ones; unresolvable entries left out
- TestMenuAPISmoke; README with API, CORS paths, import workflow and Winter adaptations
- go mod tidy records the test dependencies

plugin.go

@@ -5,6 +5,9 @@
 package menu
 
 import (
+	"net/http"
+	"time"
+
 	"git.golem15.com/golem15/sm-menu-plugin/console"
 	"git.golem15.com/golem15/sm-menu-plugin/models"
 	"git.golem15.com/golem15/sm-menu-plugin/updates"
@@ -12,14 +15,17 @@ import (
 	"git.golem15.com/golem15/summercms/modules/bonfire"
 	"git.golem15.com/golem15/summercms/modules/pact"
 	"git.golem15.com/golem15/summercms/modules/party"
+	"git.golem15.com/golem15/summercms/modules/surf"
 	"github.com/go-gormigrate/gormigrate/v2"
 )
 
 var (
-	_ party.Plugin       = (*Plugin)(nil)
-	_ pact.HasMigrations = (*Plugin)(nil)
-	_ pact.HasModels     = (*Plugin)(nil)
-	_ pact.HasCommands   = (*Plugin)(nil)
+	_ party.Plugin        = (*Plugin)(nil)
+	_ pact.HasMigrations  = (*Plugin)(nil)
+	_ pact.HasModels      = (*Plugin)(nil)
+	_ pact.HasCommands    = (*Plugin)(nil)
+	_ pact.HasRoutes      = (*Plugin)(nil)
+	_ surf.BucketProvider = (*Plugin)(nil)
 )
 
 // Plugin is the golem15.menu plugin.
@@ -52,6 +58,26 @@ func (p *Plugin) Migrations() []*gormigrate.Migration { return updates.All() }
 
 func (p *Plugin) Models() []any { return models.All() }
 
+// Buckets registers menu-public-api: 120 requests a minute per client IP
+// (behind the configured trusted proxies). 429 bodies are surf's
+// {"message":"Too Many Attempts."}.
+func (p *Plugin) Buckets() map[string]surf.Bucket {
+	trusted := surf.TrustedProxies(nil)
+	if p.app != nil {
+		trusted = surf.TrustedProxies(p.app.Config)
+	}
+	return map[string]surf.Bucket{
+		"menu-public-api": {
+			Name:  BucketPublicAPI,
+			Max:   120,
+			Decay: time.Minute,
+			Key: func(r *http.Request) string {
+				return "menu-public|" + surf.ClientIP(r, trusted)
+			},
+		},
+	}
+}
+
 func init() {
 	party.Register(&Plugin{})
 }