[codex] expose hashed community watch signals

[mashbean]

Summary

• add /signals.json as a defensive, de-identified Community Watch signals export
• include action UUID, comment ID, reason, action/review/appeal state, createdAt, and content hash
• extract contacts and URL domains as hashes only, with no raw content, full handles, or URL paths
• add POST /signals/check so downstream services can check text, contacts, and URLs without receiving raw source records
• return only verdict, confidence, and aggregated matchedSignals; cap request size to reduce abuse risk
• document API contract, abuse limits, and use restrictions in docs/signals-api.md
• include normalization version and usage notice for audit and downstream cache compatibility

Validation

• pnpm typecheck
• COMMUNITY_WATCH_API_URL=https://server.matters.town/graphql pnpm build
• local dev check: GET /signals.json returned 347 records from production API with hashed sample fields
• local dev check: POST /signals/check returned verdict: none, confidence: 0, and no raw content for a non-matching sample
• local dev check: invalid text type returns schema error