feat: clout system with tier-based queue pacing

.trivyignore

@@ -13,3 +13,6 @@ GHSA-qffp-2rhf-9h96
 
 # tar hardlink path traversal via drive-relative linkpath (npm bundled)
 CVE-2026-29786
+
+# tar node-tar <7.5.11 vulnerability (npm bundled)
+CVE-2026-31802

CREDITS.md

@@ -8,6 +8,15 @@
 
 Brand icons (TikTok, Instagram, Facebook, Spotify, Apple Music, YouTube) sourced from [Simple Icons](https://simpleicons.org) — released under [CC0 1.0 Universal](https://creativecommons.org/publicdomain/zero/1.0/).
 
+## Clout Tier Icons
+
+Icons from [Flaticon](https://www.flaticon.com), used under the [Flaticon License](https://www.flaticon.com/legal):
+
+- **Fresh** — [Toy Blocks](https://www.flaticon.com/free-icon/toy-blocks_10527515) by Freepik
+- **Rising** — [Development](https://www.flaticon.com/free-icon/development_3657083) by Freepik
+- **Viral** — [Trending](https://www.flaticon.com/free-icon/trending_18302932) by Freepik
+- **Iconic** — [Trophy](https://www.flaticon.com/free-icon/trophy_2641497) by Freepik
+
 ## Fonts
 
 Loaded via [Google Fonts](https://fonts.google.com), licensed under the [SIL Open Font License 1.1](https://opensource.org/licenses/OFL-1.1):

docs/api.md

@@ -237,6 +237,34 @@ Extends the trim deadline for a music clip in `pending_trim` status. The client
 Response: { "ok": true }
 ```
 
+## Clout (Reputation)
+
+| Method | Path | Description |
+|--------|------|-------------|
+| GET | `/api/clout` | Get user's clout score, tier, and breakdown |
+
+### GET /api/clout
+Returns the user's clout score and tier when queue pacing is enabled. Clout is computed from the engagement on the user's last 10 matured clips (48h+ old). Users with fewer than 10 matured clips default to Rising tier.
+```
+Response: {
+  "enabled": true,
+  "score": 0.8,
+  "tier": "viral",
+  "tierName": "Viral",
+  "cooldownMinutes": 120,
+  "burstSize": 3,
+  "queueLimit": null,
+  "icon": "/icons/clout/viral.png",
+  "breakdown": [{ "clipId": "...", "score": 2 }, ...],
+  "nextTier": { "tier": "iconic", "tierName": "Iconic", "minScore": 1.0, "burst": 5, "queueLimit": null, "icon": "..." },
+  "underperforming": [{ "clipId": "...", "title": "...", "platform": "tiktok", "originalUrl": "...", "thumbnailPath": "..." }]
+}
+```
+
+**Tiers:** Fresh (<0.4) → Rising (0.4–0.6) → Viral (0.7–0.9) → Iconic (≥1.0). Each tier adjusts cooldown multiplier, burst size, and queue depth limit.
+
+**Per-clip scoring:** 0 = no reactions/favorites from others, 1 = reaction or favorite but no comment, 2 = reaction/favorite AND comment. Self-interactions excluded.
+
 ## Queue Management
 
 Manage queued clips when share pacing is enabled.

docs/data-model.md

@@ -249,3 +249,4 @@ users  1──∞ verification_codes
 - **Duplicate URL prevention:** A unique index on `(group_id, original_url)` prevents the same link from being shared twice within a group.
 - **Music clip trim workflow:** Music clips enter `pending_trim` status after download. The user can trim audio via the trim UI or skip trimming. If neither occurs before `trim_deadline`, the clip auto-publishes to `ready` status via the scheduler.
 - **Dismissed clips:** The `dismissed_clips` table tracks clips dismissed by users in the catch-up modal. Users can dismiss unwatched clips in bulk, then restore them later from the Skipped Clips viewer in settings.
+- **Clout (reputation):** Computed on-demand from existing tables — no new schema. A user's clout score is the rolling average of per-clip engagement scores (0/1/2) for their last 10 matured clips (48h+ old). Scores are derived from `reactions`, `favorites`, and `comments` tables, excluding self-interactions. Tiers (Fresh/Rising/Viral/Iconic) determine queue cooldown multiplier, burst size, and queue depth limits.