feat(community): Phase 3.C — Identität (Avatar + Klarname-Toggle + Karma + Eulen-Profil)

Macht aus den Pseudonymen echte Charaktere ohne Klarnamen-Zwang.

Pixel-Identicon-Avatar (3.C.2):
- generateAvatarSvg(displayHash) — pure-function, deterministisch.
  5×5 left-mirrored Identicon mit HSL-Foreground/Background aus dem
  Hash. Inline-SVG, kein Storage, kein img-load-Flicker.
- <EulenAvatar> Component im Package, in ItemCard neben dem Pseudonym.

Klarname-Toggle (3.C.1):
- auth.users + community_show_real_name boolean (default off, opt-in).
- PATCH /api/v1/me/profile akzeptiert communityShowRealName.
- mana-analytics LEFT JOINs auth.users → bei opt-in liefert auth-
  required /public + /me/reacted Endpoints zusätzlich realName.
- Anonymous /api/v1/public/feedback/* zeigt realName NIE — auch nicht
  wenn opted-in. Public-Mirror bleibt für SEO + Privacy safe.
- Migration 008_community_identity.sql lokal + prod eingespielt.

Karma-System (3.C.3):
- auth.users + community_karma int. toggleReaction increment/decrement
  am Author-User (Self-Reactions zählen nicht — kein Self-Farming).
- KARMA_THRESHOLDS + tierFromKarma() im Package: Bronze (0-9) /
  Silver (10-49) / Gold (50-199) / Platin (200+).
- ItemCard zeigt Tier-Dot neben dem Pseudonym, Title-Tooltip mit
  Karma-Zahl. Floor-clamped at 0.

Eulen-Profil (3.C.4):
- GET /api/v1/public/feedback/eule/{hash} — alle public-Posts dieser
  Eule + aggregiertes Karma. SHA256-Format-Validation.
- /community/eule/[hash] Public-SSR-Route mit Avatar-Hero, Tier-Badge,
  Karma-Counter, Post-Liste. Author-Klick im ItemCard navigiert hin.
- publicFeedbackService.getEulenProfile() im Package.

PublicFeedbackItem erweitert um displayHash (public Pseudonym-ID,
SHA256 ist one-way → safe to expose) + karma + optional realName.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

services/mana-analytics/src/routes/feedback.ts

@@ -44,6 +44,7 @@ export function createFeedbackRoutes(feedbackService: FeedbackService) {
 			status,
 			limit,
 			offset,
+			includeRealName: true,
 		});
 
 		const enriched = await Promise.all(
@@ -87,7 +88,7 @@ export function createFeedbackRoutes(feedbackService: FeedbackService) {
 	});
 
 	r.get('/:id/replies', async (c) => {
-		return c.json(await feedbackService.getReplies(c.req.param('id')));
+		return c.json(await feedbackService.getReplies(c.req.param('id'), { includeRealName: true }));
 	});
 
 	// ── Reactions ─────────────────────────────────────────────────────

services/mana-analytics/src/routes/public.ts

@@ -33,6 +33,15 @@ export function createPublicFeedbackRoutes(feedbackService: FeedbackService) {
 		return c.json({ items });
 	});
 
+	r.get('/eule/:hash', async (c) => {
+		const hash = c.req.param('hash');
+		// Display-hashes are 64-char hex (SHA256) — bail early on garbage.
+		if (!/^[0-9a-f]{32,64}$/i.test(hash)) {
+			return c.json({ error: 'invalid display_hash' }, 400);
+		}
+		return c.json(await feedbackService.getEulenProfile(hash));
+	});
+
 	r.get('/:id', async (c) => {
 		const item = await feedbackService.getPublicItem(c.req.param('id'));
 		if (!item) return c.json({ error: 'Not found' }, 404);