[T2.5c] /activation-status endpoint (public read)

[realproject7]

Epic: #1229 · Spec: §6.3 · Type: CODE · Estimate: 0.2 day

Scope

GET /api/airdrop/activation-status?address=X
Auth: none (public read)
Response: { x_handle_confirmed_at, x_follow_at, fc_verified_at, activated_at } for the given address.
Cache: Cache-Control: no-store (RE1 round-23 — 60s cache too stale for refresh-resume).

Why no-store: this endpoint is the source of truth for ActivationFlow.tsx refresh-resume (R20 mitigation). After a user confirms their X handle or clicks follow, if they reload the page within the cache window they'd see stale null for the field they JUST set → activation flow incorrectly re-prompts. Strict no-store ensures fresh reads after each mutation endpoint succeeds.

If load becomes a concern post-launch, consider 5-10s SWR on the client side instead of server cache — but server response stays no-store.

Used by:

• ContributionPanel.tsx for activation gating
• ActivationFlow.tsx for refresh-resume (R20 mitigation — skip already-completed steps on remount)

Acceptance

• Returns 4 fields for activated wallet
• Returns all-null for non-existent address (not 404; empty object is fine, decide at PR)
• Response headers include Cache-Control: no-store (verify via curl response inspection) — refresh-resume safety per R20
• No write side effects

Dependencies

None (reads from pl_activations schema from T0.2)

[realproject7]

Completed by PR #1282.