refactor(targets): extract the insights-targets builder into lib

The targets route held a ~1.4k-line domain function in the handler body.
Move buildTargetsResponse into src/lib/targets/build-response so it sits
beside the other targets helpers and can be unit-tested without the route
shell; the route is now auth -> cachedSwr(buildTargetsResponse) -> apiSuccess.

Follow the as-needed compliance source pin to the new file location.

src/lib/analytics/__tests__/as-needed-compliance-exclusion.test.ts

@@ -36,7 +36,7 @@ const CALL_SITES: Array<{ file: string; surface: string }> = [
     surface: "insight feature extraction (c7/c30/c90)",
   },
   {
-    file: "src/app/api/insights/targets/route.ts",
+    file: "src/lib/targets/build-response.ts",
     surface: "insight targets",
   },
   {