Add public forums with inherited access rules and Vanilla migration

[jmgasper]

Companion UI: topcoder-platform/platform-ui#2444

Public forums now share the existing topic/post engine while applying inherited category permissions to reads, writes, search, counts, watches and notification recipients. Anonymous visitors can read accessible content; authenticated members can participate, with explicit copilot/reviewer and imported Vanilla-only membership restrictions.

This adds an insert-only production-Vanilla importer for dev testing and eventual production cutover. It excludes challenge/group subtrees, maps authors against the target Members database, preserves nested Markdown posts and follows/read states, refuses source/target conflicts, and verifies unchanged challenge fingerprints within the import transaction. The Prisma migration only adds metadata/provenance tables.

Validation:

• pnpm lint and pnpm build pass.
• 167 tests pass, including real PostgreSQL/HTTP guest, role, private search/watch, posting, reaction and migration rerun/conflict tests; 3 existing opt-in tests remain skipped.
• The production Docker image builds successfully.
• An unchanged full-source local rehearsal imports 57 categories, 1,355 threads and 3,756 posts; its second run inserts zero rows.

Deployment and cutover instructions are in docs/public-forums.md. Deploy this API before importing restricted content or enabling the companion Platform UI app. Production cutover remains gated on dev acceptance. Do not roll back to an API version that ignores category ACLs after importing private categories.

Dev rollout and migration verified: task revision 18, 21,440 inserted rows, immediate rerun inserted zero. All 6,437 existing challenge topics and related-row fingerprints remained unchanged. Live guest/member/copilot/reviewer catalogs and direct-access denials matched the source ACL projection. The audit, including unmapped dev identities and production gates, is in docs/public-forums-dev-migration.md. Production was not written to.