Every CI action is a CRUD action, and the URLs do not move

`CiController` had three actions named after verbs — `pipelines`, `status`,
`trigger` — and built its JSON by hand in a private `pipeline_json`, in a
codebase where everything else is serialized by Blueprinter. Triggering a
build is the creation of a run, so it is a resource of its own:

    GET  /api/ci/pipelines             -> Api::Ci::PipelinesController#index
    GET  /api/ci/pipelines/:id/status  -> Api::Ci::PipelinesController#show
    POST /api/ci/pipelines/:id/trigger -> Api::Ci::PipelineRunsController#create

The addresses are untouched on purpose: they are what the CI and the scripts
already call, and renaming them would be a breaking change for a version that
does not need one. What changed is the shape behind them — three standard
actions across two controllers, `require_ci!` and the pipeline scope in a
shared base, and a `PipelineSerializer` that carries the fields the endpoint
already answered with, `repo_id` and `woodpecker_repo_id` included (the
duplicate stays: a client may read either, and ci_controller_spec asserts they
agree).

`/api/software/highlighted` answers with `#show` now rather than `#index`: it
returns one title, and the action name should say so. Same address, same body.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/serializers/warp_engine/pipeline_serializer.rb

@@ -0,0 +1,15 @@
+module WarpEngine
+  class PipelineSerializer < Blueprinter::Base
+    field :id
+    field :repo_owner
+    field :repo_name
+    field :platform
+    field :active
+    field :last_pipeline_status
+    field :last_pipeline_at
+
+    field(:repo_id)            { |pipeline| pipeline.remote_repo_id }
+    field(:woodpecker_repo_id) { |pipeline| pipeline.remote_repo_id }
+    field(:software_name)      { |pipeline| pipeline.software&.name }
+  end
+end