feat!: clean /platforms REST contract — ordered array, slug, filter fetch handlers

[chubes4]

Summary

GET /datamachine/v1/socials/platforms returned a slug-keyed object with implicit ordering (a side effect of which new () calls fired first in data-machine-socials.php), included Reddit (a fetch handler) in a "where can I publish socially" list, and required every client to normalize capability shape and synthesize a slug field from object keys.

This is the upstream cause of the studio sidebar ordering question and a chunk of mirrored client logic across consumers.

Breaking changes

Old shape

{
  "twitter":   { "label": "Twitter", "authenticated": true, ... },
  "facebook":  { "label": "Facebook", "authenticated": false, ... },
  "instagram": { "label": "Instagram", "authenticated": true, ... },
  "reddit":    { "label": "Reddit", "type": "fetch", ... },
  ...
}

New shape

{
  "platforms": [
    { "slug": "bluesky",   "label": "Bluesky",   "authenticated": true,  ... },
    { "slug": "instagram", "label": "Instagram", "authenticated": true,  ... },
    { "slug": "twitter",   "label": "Twitter",   "authenticated": true,  ... },
    { "slug": "facebook",  "label": "Facebook",  "authenticated": false, ... },
    { "slug": "linkedin",  "label": "LinkedIn",  "authenticated": false, ... },
    { "slug": "pinterest", "label": "Pinterest", "authenticated": false, ... },
    { "slug": "threads",   "label": "Threads",   "authenticated": false, ... }
  ]
}

Server-side rules

• Filter fetch-only handlers. Reddit no longer appears. Endpoint name reflects intent (publish targets only).
• Inject slug on every entry. Clients no longer reconstruct it from object keys.
• Normalize capabilities to canonical [{slug, label}]. Legacy bare-string lists from older handlers are still accepted by the normaliser but converted; clients can rely on the canonical shape.
• Sort: authenticated first, then alphabetical by label. Stable, predictable, utility-first display order. Clients should render in array order — no client-side sort needed.
• { platforms: [...] } envelope. Leaves room to add metadata (total, last_updated, version) without another breaking change.

Verified locally

Authenticated (3): bluesky, instagram, twitter
Unauthenticated (4): facebook, linkedin, pinterest, threads
Reddit: filtered out (fetch handler)

Coordinated rollout

This is PR A of a 3-PR cluster. Merge order matters:

1. A (this PR) — REST contract change in data-machine-socials
2. B — extrachill-api-client types + getPlatforms() signature update
3. C — extrachill-studio consumes the new shape

Studio + api-client will break against this PR until B + C land. Internal getPlatforms() export in DM Socials' own src/utils/api.ts updated in this PR for consistency (the export is unused by DM Socials' Gutenberg sidebar, which uses getAuthStatus instead, so no internal regression risk).

Test plan

• ✅ php -l clean
• ✅ Live preview against production handlers confirms ordering + Reddit exclusion
• ⏳ Studio sidebar regression check after PRs B + C deploy