Tabularium 0.22.0 — Bounty lifecycle for plugin requests

• Review plugin requests before they go public: new requests start pending, and admins approve or reject them in /admin/requests, filling in bounty board metadata (tagline, scope, difficulty, next step, board label).
• Claims stay non-exclusive; an approved request with claims is shown as in progress until a plugin with its slug is approved and has an ingested manifest, then it becomes fulfilled and links to that plugin (it is no longer deleted at submit).
• Claimers of a driver or theme request can create a GitHub repository scaffolded by @tabularis/create-plugin (POST /api/requests/:id/scaffold); GitHub's workflow scope is requested only when needed.
• New webhook events request.approved, request.rejected, request.claimed, request.unclaimed, request.scaffolded, request.fulfilled, and a Static site rebuild preset for deploy hooks.
• GET /api/requests gains a status filter, claimers and votedByMe; new GET /api/requests/:idOrSlug and PATCH /api/admin/requests/:id. MCP exposes get_request, scaffold_request and admin_update_request.
• /login sends an already signed-in user back to a trusted site via GET /auth/return; /submit?repo= preselects a repository.
• New strings translated in all six locales.

Upgrade: the migration marks existing requests approved. To seed requests from the tabularis.dev bounty list, run bun run import:bounties in apps/api (try --dry-run first).

Includes PR #29. CI passed for lint, tests, TypeScript checks, frontend build, Rust checks, and Vercel cache checks.