Expose public aggregate stats and history endpoints

[tzarebczan]

Why

External dashboards and companion clients currently have to poll /ledger and cannot show holder distribution, balance concentration, or historical network activity without either scanning large tables repeatedly or exposing account-level data.

A public stats surface should be cheap to serve, cacheable, anonymous, and available to configured public origins without opening authenticated wallet APIs cross-origin.

Scope

• Add public GET /stats/summary for ledger, recent activity, active miner count, and anonymous holder aggregates.
• Add public GET /stats/history?window=24h|7d|30d&limit=N backed by per-minute snapshots.
• Maintain a user_balances rollup so holder stats do not count valid tokens on every request.
• Add route-scoped CORS via PUBLIC_STATS_ORIGINS for /ledger, /stats/summary, and /stats/history only.

Notes

This exposes aggregate balance buckets and anonymous top balances only; it does not expose holder emails. True client hash-rate history still needs explicit miner telemetry because the server only sees challenges, winning mints, and transfers.