List All Cards

List all 78 tarot cards (for info/collection screen). No auth required.

The 78 cards are static reference data (last touched in migration 004, never re-seeded). Adds an aggressive Cache-Control so CDN / mobile HTTP clients can serve repeat hits from cache instead of hitting Cloud Run. Mitigates the no-auth + no-rate-limit DDoS surface that would otherwise require a global slowapi rewrite (deferred to the Cloud Run XFF cycle). (Cycle 5 audit P1 partial mitigation.)