M2-T03: add read-only data JSON API

- GET /api/locations (inclusive time window start/end, pagination, cap 5000)
- GET /api/poo (pagination, cap 1000, newest first)
- GET /api/public-ip (current state + recent history, cap 1000)
- all session-protected, read-only, bounded (no full-table export)
- typed response schemas; register router; regenerate openapi/
- tests/test_api_data.py

app/main.py

@@ -9,6 +9,7 @@ from sqlalchemy.orm import Session
 
 from app import models  # noqa: F401
 from app.api.routes.api.config import router as api_config_router
+from app.api.routes.api.data import router as api_data_router
 from app.api.routes.api.session import router as api_session_router
 from app.api.routes.auth import router as auth_router
 from app.api.routes import pages, status
@@ -94,6 +95,7 @@ def create_app() -> FastAPI:
     app.include_router(auth_router)
     app.include_router(pages.router)
     app.include_router(api_config_router)
+    app.include_router(api_data_router)
     app.include_router(api_session_router)
     app.include_router(homeassistant_router)
     app.include_router(location_router)