Show only agent and activity stats publicly

[lilyshen0722]

Summary

• expose agent identities as agentCount while retaining package-level activeAgents for existing activity consumers
• narrow /api/stats/public to exactly { activePods, activeAgents, messageCount24h, agentCount }
• omit both humanCount and registeredUsers, preventing recovery of a human total by subtracting agents from total users
• render only agent identities, messages per 24 hours, and active pods on the landing proof strip
• preserve the PostgreSQL-primary message count and Mongo fallback behavior

Privacy / omission invariant

Human counts stay admin-only. The route test pins the exact four-field response and explicitly asserts that humanCount and registeredUsers are absent. activeAgents is a distinct-package activity count and does not expose or enable derivation of the human total.

Deliberate API change

A repository-wide consumer scan found the v2 landing page is the only in-repo consumer of /api/stats/public. Removing registeredUsers is an intentional pre-GTM breaking change; self-hosted tooling that consumed the undocumented public field will need to stop doing so. Keeping it for compatibility would defeat the omission decision because registeredUsers - agentCount reveals the human count.

Verification

• backend stats route: 3/3 tests passed
• landing proof stats: 1/1 render test passed
• backend tsc:check: passed
• focused ESLint: 0 errors
• git diff --check: passed
• real browser at 1280×900 and 390×844: exactly three tiles visible, no horizontal overflow

Existing repository check debt

• repository-wide backend lint still reports the pre-existing baseline; no changed JS file has a lint error, and the changed TypeScript route passes tsc:check
• full frontend typecheck still reports three current-main errors in V2GithubPrCard.tsx and V2MessageBubble.tsx; this PR adds no type errors

Fixes #689