Add api/v1/stats/user/:username/rounds endpoints

[bpfoley]

Code borrowed from theme.inc show_tally_specific_stats

---

Test hint edit from @cpeel courtesy of @bpfoley:

API_KEY=<api key here>
ROOT=https://www.pgdp.org/~bfoley/c.branch/user-stats-api
curl -X GET "$ROOT/api/v1/stats/user/bfoley/rounds" \
   -H "Accept: application/json" \
   -H "X-API-KEY: $API_KEY"

curl -X GET "$ROOT/api/v1/stats/user/bfoley/rounds/P1" \
    -H "Accept: application/json" \
    -H "X-API-KEY: $API_KEY"

[srjfoo]

At first I was confused, because ordinary users can see a stats page for all users except those that have specifically set their stats to private. Then I realized that this is not just the plain vanilla stats page that everyone sees, but the table that only squirrels and some PFs see (access-request reviewers, I think?).

[cpeel]

At first I was confused, because ordinary users can see a stats page for all users except those that have specifically set their stats to private. Then I realized that this is not just the plain vanilla stats page that everyone sees, but the table that only squirrels and some PFs see (access-request reviewers, I think?).

That's a good point when thinking about the future of this endpoint. Right now it's more restrictive than it might need to be -- which is fine. If/when in the future we add more user stats and allow users to see other's stats as long as they aren't marked as private, should the ones we're showing here be handled differently?

My gut says no -- that we could just make what's in this PR fall into the same access constraints.

[srjfoo]

At first I was confused, because ordinary users can see a stats page for all users except those that have specifically set their stats to private. Then I realized that this is not just the plain vanilla stats page that everyone sees, but the table that only squirrels and some PFs see (access-request reviewers, I think?).

That's a good point when thinking about the future of this endpoint. Right now it's more restrictive than it might need to be -- which is fine. If/when in the future we add more user stats and allow users to see other's stats as long as they aren't marked as private, should the ones we're showing here be handled differently?

My gut says no -- that we could just make what's in this PR fall into the same access constraints.

I agree. I think the only place that normal users can see actual numbers is in the neighborhood listing. Otherwise, they just see the basic user information (DP Profile, Forums Profile and list of teams, and links to P1-F2 charts. Which you can get numbers from by hovering over the bar, but it's kind of painful.

At this point, I don't think any of the access-request reviewers is at all interested in pulling an app together using the API 😁