Serves the host's design manifest as JSON for agent consumption.

Hosts wire this up by passing their manifest module via route :private:

scope "/" do
  pipe_through :authenticated_json
  get "/design.json", JobyKit.ManifestController, :show,
    private: %{joby_kit_manifest: MyAppWeb.DesignManifest}
end

The controller does not enforce auth on its own — that's the host's pipeline's responsibility. Pair it with a JSON-accepting authenticated pipeline (or a public pipeline if the manifest is OK to expose).