Resolve an issued reward's manifest by its public slug.

This URL is written into every issued reward as its manifest_url and resolved by whoever holds the reward, so it lives at the root rather than under /api/v1 and is not versioned.

Returns the reward's slug, issued_at and content.

A reward issued with an access key is refused without it: present the key as Authorization: Bearer <access_key>. A missing or wrong key answers 403, an unknown slug 404. Rewards issued without a key need no header.

curl -X GET "https://api.davi.social/reward/{slug}" \
  -H "Authorization: Bearer <token>"