feat: sponsors public API (backend)

[balebbae]

Summary

Implement the backend for the sponsors public API. This follows the same patterns as the existing schedule public API.

What to build

1. DB Migration

Create 000023_create_sponsors.up/down.sql:

CREATE TABLE sponsors (
  id            UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
  name          TEXT        NOT NULL,
  tier          TEXT        NOT NULL DEFAULT 'standard',
  logo_path     TEXT,
  website_url   TEXT,
  description   TEXT,
  display_order INT         NOT NULL DEFAULT 0,
  created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  updated_at    TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

2. Store layer

• Add internal/store/sponsors.go with SponsorsStore implementing List, Create, Update, Delete, GetByID
• Wire it into internal/store/storage.go

3. GCS client changes

• Add GeneratePublicURL(objectPath string) string to the GCS interface + client — just returns https://storage.googleapis.com/{bucket}/{path} (permanent public URL for logo delivery)
• Add a separate image upload URL generator (current one is hardcoded to application/pdf)

4. API handlers (cmd/api/sponsors.go)

Superadmin routes (wire under /v1/superadmin/sponsors):

• POST / — create sponsor
• GET / — list all sponsors
• PUT /{id} — update sponsor metadata
• DELETE /{id} — delete sponsor + best-effort GCS logo delete
• POST /{id}/logo-upload-url — returns signed PUT URL for direct browser-to-GCS upload (same pattern as resume upload URL)

Public route (wire under /v1/public/sponsors, API key auth):

• GET / — returns sponsors list; resolve logo_path → logo_url via GeneratePublicURL

5. Wire routes in cmd/api/api.go

Notes

• Follow the same patterns as schedule.go and resume.go
• The public endpoint is consumed by the marketing Next.js site — logo URLs must be stable/permanent (not signed)
• Do NOT touch GCS bucket configs — once the backend implementation is complete, contact Caleb to update the GCS bucket permissions to make the sponsors/ prefix publicly readable