GET /api/v1/repos/:owner/:name/iterations answers the fork family's runs and pins as JSON, the same the Iterations page draws #9125

Intent: the Iterations page (#9096) and its terminal screen are reachable only by eye; an agent or script should read the same family tree as plain data.

Today iterationsOf, lanesOf and familyRepos live in src/web/pages/iterations_family.ts, and only src/web/pages/iterations.ts and src/tui/screens/iterations.ts call them.

Done looks like:

• [x] The family reading moves to a module named for the concept (e.g. src/core/iterations.ts or src/git/iterations.ts), plain data in and out; the page and the TUI screen import it from there and draw exactly what they drew before.
• [x] GET /api/v1/repos/:owner/:name/iterations (routed beside builds in src/http/api/builds.ts or its own src/http/api/iterations.ts) answers { forks: [...], lanes: [...] } for the viewer: the same forks, pins (label, sha, date, note, parent) and lanes the page shows, at most 40 repositories.
• [x] A private repository the viewer may not read is a 404; a private fork is absent for someone who may not read it; a family with no pin answers 200 with empty lists (the page's 404 stays the page's).
• [x] The route has an OpenAPI description under src/contract/openapi/routes/ and docs/features/iterations.md names it.
• [x] A test in test/ reads the route as a reader, a stranger and signed out, and asserts it lists the same pins as the page for each.

Risk: the family walk reads git for up to 40 repositories; reuse the 5-second pins cache so the route answers as fast as the page.

Reviewed pull #9145 at its head: ticked The family reading moves to a module named for the concept (e.g. src/core/iterations.ts or src/git/iterations.ts), plain data in and out; the page and the TUI screen import it from there and draw exactly what they drew before.; GET /api/v1/repos/:owner/:name/iterations (routed beside builds in src/http/api/builds.ts or its own src/http/api/iterations.ts) answers { forks: [...], lanes: [...] } for the viewer: the same forks, pins (label, sha, date, note, parent) and lanes the page shows, at most 40 repositories.; A private repository the viewer may not read is a 404; a private fork is absent for someone who may not read it; a family with no pin answers 200 with empty lists (the page's 404 stays the page's).; The route has an OpenAPI description under src/contract/openapi/routes/ and docs/features/iterations.md names it.; A test in test/ reads the route as a reader, a stranger and signed out, and asserts it lists the same pins as the page for each..