Add read-only API endpoints for public projects and expeditions

[rbruhn]

Adds read-only API endpoints for the public projects and expeditions, and documents them on the API page. Closes #82.

Endpoints

Endpoint	Returns
GET /v1/projects	Paginated public projects
GET /v1/projects/{uuid}	One project
GET /v1/expeditions	Paginated public expeditions
GET /v1/expeditions/{uuid}	One expedition

• Public means the same as on the site: projects with a Zooniverse project, and expeditions with a Zooniverse project and the Zooniverse actor (the existing publicProjectIndexQuery() / publicIndexQuery() in the services, without the page cache). Anything else returns 404.
• Query: per_page (1–100, default 25) and page on lists; project_uuid and status (active / completed) on expeditions. Responses are standard Laravel resource pagination (data, links, meta).
• Fields: projects omit the contact name and email. An expedition's links.participate is its Zooniverse classify URL only while it's processing there, as on the public card.
• Uses the previously unused ExpeditionResource / ExpeditionCollection, plus new ProjectResource / ProjectCollection. PanoptesProjectPresenter gets a participateUrl() that returns the plain URL.

Token ability

• New public:read ability, required by the new routes and added to the v1 group's list.
• The WeDigBio dashboard route now checks its own four abilities explicitly, so existing tokens behave as before and a public:read-only token gets 403 there.
• Nothing issues tokens yet; create them by hand, e.g. $user->createToken('name', ['public:read']).

API page

front/api-index now covers authentication, the rate limit, the endpoints, query parameters and an example response. The Apiary and GitHub buttons are unchanged.

Tested locally

• tests/Feature/Api: 17 passed (new ProjectControllerTest, ExpeditionControllerTest, and a dashboard 403 case in ApiAccessTest).
• tests/Feature/Api, tests/Feature/Front, presenter tests: 297 passed.
• The API index page renders (200).

To verify on development

See #567.