List the browsable Funko unlock catalog

Public, no auth, edge-cacheable. Returns every non-hidden catalog row projected through an explicit allowlist (id, kind, label, blurb, rarity, requires, asset). Carries NO per-member data of any kind, which is what makes a shared cache safe here; a member's own unlock state is GET /api/funko/progress, which is self-only.