420 Attention API and privacy boundary

Derived APIs may expose public campaign metadata, consent status appropriate to the authenticated user, proof/reward status and campaign liability summaries.

Public APIs must not expose raw behavioral telemetry, private targeting data, delivery endpoints or unrelated personal information. Security-sensitive clients should re-read canonical proof/reward state.