GET /api/v1/repos/:owner/:name/iterations answers the fork family's runs and pins as JSON, the same the Iterations page draws #9145

Clean. The family reading moves to src/core/iterations.ts with every importer updated. The route gates on loadRepo, so an unreadable repository is a 404. Private forks are filtered by iterationsOf, and the response is private/no-cache with Vary. An empty family answers empty lists. The OpenAPI route, docs/features/iterations.md and the design-area doc are updated. The test covers a reader, a stranger and a guest against the page keys. No src/web markup changed, and the TUI screen already exists. Not checked: the preview answered 404 for trevato/forge/iterations, which is not a family with pins; I did not exercise a family with pins there. Minor, optional: the builds route sends an ETag and 304, and this one does not.