feat(shields): add Shields.io community badges

[hmans]

Why

Self-hosted communities need opt-in badges they can embed in READMEs and websites without exposing identities or requiring Chatto sessions.

What Changed

• Adds public, disabled-by-default Shields.io endpoint badge data under /.well-known/chatto/shields/{online,registered}.json.
• Adds matching .png convenience redirects to Shields.io instead of rendering badge images in Chatto.
• Nests the opt-in config under [webserver.shields] with CHATTO_WEBSERVER_SHIELDS_ENABLED, and enables it in the local development cli/chatto.toml.
• Uses the PresenceHub live snapshot for the online count and verified-account semantics for the registered count.
• Documents the public route inventory, privacy/operational tradeoffs, and integration examples in FDR-029, architecture docs, the environment variable reference, and the docs website guide.

Compatibility And Operations

• This adds a new opt-in unauthenticated HTTP surface; disabled servers return 404.
• Enabling it publishes aggregate server size/activity counts and lets Shields.io fetch the JSON endpoints.

Test Plan

• mise x -- go test ./internal/core -run 'TestPresence|TestCountVerified' -timeout 30s
• mise x -- go test -tags test_endpoints ./internal/http_server -run TestShields -timeout 30s
• mise x -- go test ./internal/config -run TestReadConfig_Shields -timeout 30s
• mise x -- pnpm build:docs
• mise test-cli