feat(programs): Denver programs + Past-programs surface + public projects from signups

[sacha-l]

Summary

Three related pieces for surfacing past programs and what was built/pitched at them.

1. Denver programs — repurpose dogfooding-2026-berlin → Dogfooding 2026 Denver (dogfooding-2026-denver, completed, luma.com/dogfooding copy); add PitchOff! Denver 2026 (pitch_off, completed, 2026-02-21).
2. Past-programs surface — /programs now fetches all programs and renders a "Past programs" section below the open grid; the rack card badge reflects status (OPEN / COMPLETED / CLOSED) instead of a hardcoded OPEN.
3. Public PROJECTS section — /programs/:slug shows the distinct projects attendees picked (+ interest counts), aggregated from the program's signups, PII-free.

The PROJECTS feature (new)

• Endpoint: GET /programs/:slug/projects — public, no auth. Returns [{ project, count }] sorted by count desc. Raw signups stay admin-gated; only this safe aggregate is public.
• Aggregation (programSignupService.projectSummaryByProgramId): groups program_signups by the raw_row column whose header matches /project/i, counting distinct values. No attendee fields are ever returned.
  • Heuristic note: I match the project column by name (/project/i) because the exact CSV header isn't pinned yet. Trivial to hard-pin once the real export lands (see feat: import real PitchOff! submissions CSV + pin the project column #143).
• Client: api.listProgramProjects(slug) with a mock branch; a representative mockProgramSignups['pitchoff-2026-denver'] fixture so the preview renders. ProgramDetailPage shows a PROJECTS panel when non-empty (hidden otherwise).
• PII: only project name + interest count are exposed; attendee name/email/Telegram never leave the admin gate. Verified by a tester scenario.

How submissions get there (already shipped, not in this PR)

Admins upload/update each program's CSV at /admin/programs/:slug (ProgramSignupsSection: file picker → dry-run preview → commit → list/delete). This PR makes the public projection of that data visible.

Deferred → #143

• Importing the real PitchOff! submissions CSV (blocked on the file from @sacha) — the mock fixture stands in until then.
• Any richer custom PitchOff! layout beyond the projects list.

Decisions (flag if wrong)

• status = completed for both Denver programs (matches symbiosis-2025). Say the word for closed.
• Denver dogfooding event dates left null (no signal); PitchOff event date 2026-02-21 from the export timestamps.

Files changed

• client/src/lib/mockPrograms.ts — Denver + PitchOff entries; mock signups fixture; projectSummaryFromMockSignups.
• client/src/lib/mockProgramApplications.ts — repoint programId.
• client/src/lib/api.ts — ApiProgramProject + listProgramProjects.
• client/src/pages/ProgramsPage.tsx — Past-programs section; status-aware badge.
• client/src/pages/ProgramDetailPage.tsx — PROJECTS section.
• server/api/services/program-signup.service.js — projectSummaryByProgramId.
• server/api/controllers/program.controller.js — listProjects.
• server/api/routes/program.routes.js — public GET /:slug/projects.
• server/api/services/__tests__/program-signup.service.test.js — new aggregation tests.
• server/scripts/seed-dogfooding-program.js — seeds the Denver dogfooding row.

Manual Supabase rollout (prod)

(unchanged from before — repurpose the Berlin dogfooding row to Denver, insert PitchOff!; SQL below)

UPDATE programs SET
  id='dogfooding-2026-denver', slug='dogfooding-2026-denver', name='Dogfooding 2026 Denver',
  status='completed', location='Denver', event_url='https://luma.com/dogfooding',
  applications_open_at=NULL, applications_close_at=NULL, event_starts_at=NULL, event_ends_at=NULL,
  description='Whether you''re new to web3 or deep in it — when''s the last time you actually used a new product, not just heard about one? Dogfooding Denver showcased 3–4 products built by WebZero hackathon teams. No jargon-filled panels, no slideshows — just hands-on time with real apps. Attendees picked a product, spent 30 minutes on guided tasks, and submitted feedback that went directly to the builders. No technical background or wallet required — just curiosity. The feedback shapes what gets built next.'
WHERE id='dogfooding-2026-berlin';

INSERT INTO programs (id,name,slug,program_type,description,status,owner,location,event_starts_at,event_ends_at)
VALUES ('pitchoff-2026-denver','PitchOff! Denver 2026','pitchoff-2026-denver','pitch_off',
  'A live pitch event in Denver where WebZero builders presented their projects to the room. Attendees signed up, chose the projects they were most excited about, and could opt into the bounty round.',
  'completed','webzero','Denver','2026-02-21T00:00:00Z','2026-02-21T23:59:59Z');

Then import the PitchOff! signups CSV at /admin/programs/pitchoff-2026-denver to populate the public PROJECTS list.

Test plan

• npm test (server) — 252 passed (4 new aggregation tests).
• npm run build (client) — green.
• npm run lint (client) — clean.
• stadium-tester @ localhost (mock) — Past-programs 8/8, PROJECTS section 5/5 (incl. a PII-leak check + empty-state check).
• Visual review on the Vercel preview.
• Supabase rollout + CSV import after merge.

stadium-tester report (PROJECTS)

**Scenarios**: 4 + sanity, all PASS
| # | Scenario                                                      | Result |
|---|---------------------------------------------------------------|--------|
| 1 | PitchOff! page shows a PROJECTS section                        | PASS   |
| 2 | projects render w/ counts, top project first (4 INTERESTED)    | PASS   |
| 3 | no attendee PII (email / "Attendee 1") on the public page      | PASS   |
| 4 | program without signups shows no PROJECTS section              | PASS   |

window.__STADIUM_MOCK__ = true · console errors: 0

Invariants respected

• New public route exposes only aggregates; raw signups remain requireProgramAdmin.
• No console.* (client); dark mode only; reused tokens.
• No Mongoose in server/api/**; no new Supabase script.
• ESM; BYPASS_ADMIN_CHECK untouched.

Per CLAUDE.md §6: draft, never merging.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
stadium	Ready	Preview, Comment	May 22, 2026 12:40am

[sacha-l]

Update: projects pivoted from vote-counts → builder project cards.

The PitchOff! submissions turned out to be per-project builder entries (name, what they built, GitHub repo, README/doc link, tools), not vote tallies. So the public PROJECTS section now renders project cards (name · blurb · REPO/DOCS links · tool tags) instead of "N interested".

• GET /programs/:slug/projects now returns [{ name, description, repoUrl, docsUrl, tags }] — one signup row → one public-safe card; PII columns (telegram/email/contact) are never read; non-URL links + empty cards dropped.
• Mock fixture seeded with a best-effort transcription of the responses screenshot (names + tools as legible; descriptions + repo/doc URLs left blank pending the real CSV). Preview-only — prod stays empty until the real import (feat: import real PitchOff! submissions CSV + pin the project column #143).
• Server 256 tests green; stadium-tester 5/5 incl. a PII-leak check and empty-state check.