feat: add public-api app and route update checks through it

- Add `apps/public-api` (`@sofa/public-api`) — minimal Hono app
  deployable to Vercel; `GET /v1/version` fetches the latest GitHub
  release and returns `{ version, releaseUrl }` with a 15-minute
  CDN cache (`s-maxage=900, stale-while-revalidate=3600`)
- Update `packages/core/src/update-check.ts` to call
  `PUBLIC_API_URL/v1/version` instead of the GitHub API directly;
  `PUBLIC_API_URL` defaults to `https://public-api.sofa.watch`

apps/public-api/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@sofa/public-api",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "PORT=3002 bun --watch src/app.ts",
+    "start": "PORT=3002 bun src/app.ts",
+    "lint": "biome check",
+    "format": "biome format --write",
+    "check-types": "tsc --noEmit"
+  },
+  "dependencies": {
+    "hono": "4.12.7"
+  },
+  "devDependencies": {
+    "@types/bun": "catalog:",
+    "typescript": "catalog:"
+  }
+}

apps/public-api/src/app.ts

@@ -0,0 +1,29 @@
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { getLatestVersion } from "./lib/github";
+
+const app = new Hono();
+
+app.use("*", cors());
+
+app.get("/health", (c) => c.json({ status: "healthy" }));
+
+app.get("/v1/version", async (c) => {
+  try {
+    const latest = await getLatestVersion();
+
+    c.header(
+      "Cache-Control",
+      "public, s-maxage=900, stale-while-revalidate=3600",
+    );
+
+    return c.json(latest);
+  } catch (e) {
+    return c.json(
+      { error: e instanceof Error ? e.message : "Failed to fetch version" },
+      502,
+    );
+  }
+});
+
+export default app;

apps/public-api/src/lib/github.ts

@@ -0,0 +1,31 @@
+const GITHUB_RELEASES_URL =
+  "https://api.github.com/repos/jakejarvis/sofa/releases/latest";
+
+export interface VersionInfo {
+  version: string;
+  releaseUrl: string;
+}
+
+export async function getLatestVersion(): Promise<VersionInfo> {
+  const res = await fetch(GITHUB_RELEASES_URL, {
+    headers: {
+      Accept: "application/vnd.github.v3+json",
+      "User-Agent": "sofa-public-api",
+      ...(process.env.GITHUB_TOKEN && {
+        Authorization: `Bearer ${process.env.GITHUB_TOKEN}`,
+      }),
+    },
+    signal: AbortSignal.timeout(10_000),
+  });
+  if (!res.ok) throw new Error(`GitHub API ${res.status}`);
+
+  const data = (await res.json()) as {
+    tag_name: string;
+    html_url: string;
+  };
+
+  return {
+    version: data.tag_name.replace(/^v/, ""),
+    releaseUrl: data.html_url,
+  };
+}

apps/public-api/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2017",
+    "lib": ["esnext"],
+    "strict": true,
+    "noEmit": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "isolatedModules": true,
+    "skipLibCheck": true,
+    "types": ["bun"]
+  },
+  "include": ["**/*.ts"],
+  "exclude": ["node_modules", "dist"]
+}

apps/public-api/vercel.json

@@ -0,0 +1,3 @@
+{
+  "bunVersion": "1.x"
+}