PUBLIC (no auth) — the CURATED list of shared results we point at.

Item 20, and the honesty of it is the whole design:

• It is a list somebody CHOSE, never a ranking. Sorting members' shared results by return and publishing the top of that list is marketing by survivorship — the winners of a lottery presented as evidence. We refuse to build the mechanism, not just the page.
• WHERE THE CHOICE IS STORED: the admin-curated vega_featured_shares table when it has anything in it, and otherwise the older VEGA_FEATURED_SHARES environment variable — which keeps every existing deploy working unchanged. public_share.resolve_featured_tokens is the one place that decides, and its docstring is the reasoning.
• It is not an enumeration. This is the ONLY route that lists share tokens, and it lists exactly the ones an operator named — nothing here sweeps the table, so no stranger can walk it to discover somebody else's link.
• A token that has been REVOKED (or whose run was deleted) simply does not resolve, so it drops out of this list and out of the next generated sitemap with no cleanup step to forget. Curation cannot outlive consent — which is why the resolution below goes through db.get_share for every token, whichever source named it.

Returns {"shares": [{token, path, strategy_name, verdict, n_fills, shared_at}]} — the card fields only, in the operator's order.