remove username as public input from /sponsors/github

Extends the previous commit's fix. The only caller (Donate.vue via
apiService.getSponsors()) never sends a username and always relied on the
server-side default, so the parameter had no legitimate use even after
being parameterized — it just let anyone use deflock's server as an
unauthenticated relay onto GitHub's GraphQL API under the server's own
token. Drop it entirely: the route no longer accepts a username
querystring param, and GithubClient.getSponsors() takes no argument,
hardcoding the maintainer's login via MAINTAINER_USERNAME. Keeps the
$username GraphQL-variable parameterization technique so reintroducing a
variable input later can't reintroduce the injection.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

api/services/GithubClient.ts

@@ -3,6 +3,7 @@ import { Type, Static } from '@sinclair/typebox';
 
 const GITHUB_TOKEN = process.env.GITHUB_TOKEN || '';
 const graphQLEndpoint = 'https://api.github.com/graphql';
+const MAINTAINER_USERNAME = 'frillweeman';
 
 export const SponsorSchema = Type.Object({
   sponsor: Type.Object({
@@ -17,17 +18,18 @@ export type Sponsor = Static<typeof SponsorSchema>;
 
 export const SponsorsResponseSchema = Type.Array(SponsorSchema);
 
-// Pass the username as a GraphQL variable rather than interpolating it into the
-// query string, so a value containing quotes or other GraphQL syntax cannot
-// break out of the string literal and alter the query.
-export const buildSponsorsQuery = (username: string): { query: string; variables: { login: string } } => ({
-  query: `query($login: String!) { user(login: $login) { sponsorshipsAsMaintainer(first: 100) { nodes { sponsor { login name avatarUrl url } } } } }`,
-  variables: { login: username },
+// The maintainer's username is passed as a GraphQL variable rather than
+// interpolated into the query string. It's a hardcoded constant today, but
+// keeping this indirection means a future caller-supplied value can never
+// break out of the query text the way the old string-interpolated version did.
+export const buildSponsorsQuery = (): { query: string; variables: { username: string } } => ({
+  query: `query($username: String!) { user(login: $username) { sponsorshipsAsMaintainer(first: 100) { nodes { sponsor { login name avatarUrl url } } } } }`,
+  variables: { username: MAINTAINER_USERNAME },
 });
 
 export class GithubClient {
-  async getSponsors(username: string): Promise<Sponsor[]> {
-    const { query, variables } = buildSponsorsQuery(username);
+  async getSponsors(): Promise<Sponsor[]> {
+    const { query, variables } = buildSponsorsQuery();
     const body = JSON.stringify({ query, variables });
     const response = await fetch(graphQLEndpoint, {
       method: 'POST',