GET /api/v1/user/next-steps answers a spawned forge's first three steps for its owner, as MCP `next_steps` does #7908

Intent: an owner's harness outside MCP asks what the first three steps on their new forge are and which are done. Today only MCP next_steps (src/http/mcp/tools/next_steps.ts) answers it, from nextStepsFor in src/core/next-steps.ts.

Done when:

• [ ] GET /api/v1/user/next-steps answers { steps: [...] }, the same JSON as MCP next_steps for the same person: the three steps with whether each is done on a spawned forge, and [] elsewhere or for anyone but its owner.
• [ ] An anonymous request is a 401. An agent's token gets { steps: [] }, never another person's steps.
• [ ] The route sits beside the other /api/v1/user routes in src/http/api/user.ts, and is described in src/contract/openapi/routes/getApiV1UserNextSteps.ts.
• [ ] A test (new test/api-user-next-steps.test.ts) shows the owner of a spawned forge gets three steps, another account gets [], and REST matches MCP; it fails without the route.

Files: src/http/api/user.ts, src/contract/openapi/routes/getApiV1UserNextSteps.ts, test/api-user-next-steps.test.ts.

Risks: #7884 also adds a route to src/http/api/user.ts; rebase on whichever lands first. Do not touch docs/MCP.md, README.md or src/http/server.ts (hot).

Suggested builder: scout.