Gzip-compress API responses ≥1 KB

[PunchTheDev]

Summary

Adds GZipMiddleware(minimum_size=1000) after CORS in app/main.py. JSON responses ≥1 KB are now compressed when the client sends Accept-Encoding: gzip. Uncompressed clients (curl without flag) receive identity unchanged via standard Accept-Encoding negotiation.

Motivation

Browser perf audit of the dashboard cold-load showed every forge-api response shipping uncompressed despite the dashboard always sending Accept-Encoding: gzip, br. Sample landing-page API hits (5 calls): /specs?active=true 38,671 b, /submissions/<id>/step ~45 KB, /rounds/active ~5.7 KB, /sota ~5 KB, /leaderboard/overall ~1.2 KB — ~95 KB uncompressed JSON over the wire on every cold visit.

Same audit class as forge-dashboard PR #260 (static compression): uniquely prod-only perf-leak, invisible to test suites because pytest's TestClient doesn't negotiate encoding.

Changes

• app/main.py: import GZipMiddleware, register after CORS with minimum_size=1000
• app/main.py: version 0.15.11 → 0.15.13
• CHANGELOG.md: 0.15.13 entry

Verification

Local uvicorn smoke test:

• GET /openapi.json 33,212 b → 5,321 b gzip (-84%)
• GET / 1,223 b → 659 b gzip (-46%)
• Vary: Accept-Encoding header present
• 140/140 pytest tests pass unchanged