[diangogav]

Summary

• Adds GET /users/by-username/:username/emote-bar. It returns the same shape as GET /me/emote-bar: 8 slots, each { ref, packId, assetUrl, packUrl, assetsExpiresAt }, with signed URLs for pack emotes.
• The opponent's client uses it to play the sender's pack emotes, and to drop any emote that is not in the sender's bar.
• It behaves like /users/by-username/:username/loadout:
  • It is public.
  • An unknown username returns 404.
  • Banned users are served the same way.
  • There is no rate limit.
  • Responses carry Cache-Control: private, no-store.
• GetPublicEmoteBar resolves the username and reuses GetMyEmoteBar, so stale slots fall back to distinct defaults here too.

Context

This is part of the emote packs feature. The earlier steps are #109 to #112, plus diangogav/EDOpro-server-ts#418 on the duel server. With this PR the API side is complete. The web client comes next.

Verification

• bun test: 687 pass, 0 fail.
• bun run lint and bun run build --noEmit are clean.