feat(api): implement GET /bounties/:id bounty detail

[automaton365-sys]

Implements bounty detail endpoint enhancements requested in #21.\n\n### What changed\n- Updated to return:\n - full bounty details\n - info (, )\n - \n - info if assigned (, )\n- Added tests in for:\n - successful response shape\n - 404 when bounty is missing\n\n### Notes\n- Followed existing route/test style and DB query conventions.\n\nFixes #21\n/claim #21

[devasign-app]

🟡 AI Code Review Results

Status: Review Recommended
Confidence: 100%

---

🟡 Merge Score: 80/100

🟡 ████████████████░░░░ 80%

Recommendation: ⚠️ This PR is mostly good but could benefit from some improvements before merging.

The PR correctly implements the feature with good tests. However, it contains a notable performance inefficiency in how it counts applications. A suggested optimization using a database COUNT query is provided to address this before merging.

💡 Code Suggestions (1)

🟡 Medium Priority (1)

1. packages/api/src/routes/bounties.ts (Line 141)
   ⚡ The current implementation fetches all application records for a bounty just to count them. This is inefficient and can cause performance issues for bounties with many applications, as it transfers all record IDs to the application server just for a count.

💭 Reasoning: Using a dedicated SQL COUNT aggregate query allows the database to perform the counting operation itself. This is significantly more performant as it reduces data transfer over the network to a single number and lowers memory consumption on the application server.

Suggested Code:

const [[{ count: applicationCount }], creator, assignee] = await Promise.all([
    db.select({ count: sql<number>`cast(count(*) as int)` }).from(applications).where(eq(applications.bountyId, bounty.id)),
    db.query.users.findFirst({
        where: eq(users.id, bounty.creatorId),
        columns: { username: true, avatarUrl: true },
    }),
    bounty.assigneeId
        ? db.query.users.findFirst({
            where: eq(users.id, bounty.assigneeId),
            columns: { username: true, avatarUrl: true },
        })
        : Promise.resolve(null),
]);

return c.json({
    ...bounty,
    application_count: applicationCount,
    creator: creator
        ? {
            username: creator.username,
            avatar_url: creator.avatarUrl,
        }
        : null,
    assignee: assignee
        ? {
            username: assignee.username,
            avatar_url: assignee.avatarUrl,
        }
        : null,
});

📊 Review Metadata

• Processing Time: 106s
• Analysis Date: 3/3/2026, 7:58:03 PM

🤖 This review was generated by AI. While we strive for accuracy, please use your judgment when applying suggestions.

💬 Questions about this review? Open an issue or contact support.

[devasign-agent]

The PR enhances GET /bounties/:id to include creator info, assignee info (when assigned), application count, and status, and adds tests for the success shape and 404 case. Implementation follows existing route/test conventions.

[devasign-agent]

End goal

The GET /bounties/:id endpoint returns complete bounty detail including creator info, application count, assignee info when assigned, and current status, with proper handling for missing bounties.

✅ Acceptance criteria met (all 7 met)

• C1 — GET /bounties/:id returns the full bounty details for an existing bounty.
• C2 — The response includes creator info containing username and avatar.
• C3 — The response includes the application count for the bounty.
• C4 — The response includes assignee info (e.g., username and avatar) when the bounty is assigned.
• C5 — The response includes the bounty's current status.
• C6 — The endpoint returns a 404 when the requested bounty does not exist.
• C7 — Tests cover the successful response shape and the 404-missing-bounty case.

---

The endpoint returns full bounty details enriched with creator info, assignee info (when assigned), application count, and status, and returns 404 for missing bounties. Tests cover both the success shape and the 404 case. All criteria are satisfied.