feat(routes-b): add trust-score history endpoint (#619)

[pragmaticAweds]

Summary

• Adds GET /api/routes-b/trust-score/history?days=30|90|365 returning { days, history: [{ date, score }] } in ascending date order
• Per-user in-memory ring buffer holds the last 365 daily snapshots, bounding memory across recompute frequency
• Same-day recomputes overwrite the day's score (latest wins) so history is one entry per UTC day
• Snapshot is recorded inside recomputeTrustScore after each successful upsert, so the endpoint and the history stay in lock-step
• days defaults to 30 and rejects anything outside {30, 90, 365} with INVALID_RANGE so we don't expose buckets we never advertised

Scope

All changes live inside app/api/routes-b/:

• app/api/routes-b/_lib/trust-score-history.ts (store + validators)
• app/api/routes-b/trust-score/history/route.ts (new endpoint)
• app/api/routes-b/trust-score/route.ts (snapshot hook in the recompute path)
• app/api/routes-b/trust-score/__tests__/history.test.ts (tests)

Behavior / acceptance

• Memory is bounded by the per-user 365-entry cap (oldest dropped first)
• History is returned in ascending date order
• 403 without a valid bearer token, matching /trust-score's contract

Test plan

• Empty history before any snapshot
• Same-day recompute overwrites the day's score (latest wins)
• Builds up across multiple days in ascending order
• 365-day retention cap drops oldest entries first
• days=30 / 90 / 365 filters return only entries within the window
• No history leaks across users
• isAllowedRange accepts only 30 / 90 / 365
• Endpoint rejects out-of-range days with INVALID_RANGE
• Endpoint returns 403 without a valid token

Out of scope

• Persistent (database-backed) history — issue explicitly defers this
• Component-level history — separate issue

Closes #619

[vercel]

@pragmaticAweds is attempting to deploy a commit to the david's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@pragmaticAweds Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits