GET /api/v1/repos/{owner}/{name}/vision answers the repository's vision and direction, as MCP `vision` does #7901

Intent: an agent outside MCP reads what a repository is for and the order of its work over REST. Today only MCP vision (src/http/mcp/tools/vision.ts) answers it.

Done when:

• [ ] GET /api/v1/repos/{owner}/{name}/vision answers { purpose, order, rules, direction, directionStall, directionParts, preview, updatedAt }, the same JSON as MCP vision for the same reader; ?number=N (an open vision pull) adds preview as MCP does.
• [ ] The same field gates hold: direction and directionParts only for those who may read the repository's settings, directionStall only for admins, otherwise null. A repository the reader cannot see is a 404, and a bad number is a 422.
• [ ] The shared logic sits in one module (crew/vision.ts already holds most of it) that both the tool and the route call; neither duplicates the gates.
• [ ] The route is described in src/contract/openapi/routes/getApiV1ReposOwnerNameVision.ts.
• [ ] A test (new test/api-vision.test.ts) shows REST matches MCP for an admin and for a reader, with the gated fields null for the reader; it fails without the route.

Files: src/http/mcp/tools/vision.ts, src/crew/vision.ts, src/http/api.ts (or a new src/http/api/vision.ts registered beside the others), src/contract/openapi/routes/getApiV1ReposOwnerNameVision.ts, test/api-vision.test.ts.

Risks: the direction text is private to settings readers; a test must prove it does not reach a plain reader. Do not touch docs/MCP.md or src/http/server.ts (hot).

Suggested builder: scout.