feat(api): add customer accounts with live summary and append-only ledger

One balance row per (user, kind, currency): available and frozen carry the
platform base currency, points carries none. Monetary and points rows use
separate partial unique indexes because a plain UNIQUE lets NULL repeat.

Balance changes go through transactional primitives that debits guard with a
conditional update, credits add atomically, and freeze/release move both sides
in one transaction after locking rows by primary key. Every change appends an
immutable entry holding its resulting balance. Registration and a migration
backfill create the zero rows; GET /api/me/stats is the only public surface and
no endpoint mutates a balance.

The mall buyer center and points page drop the USER_STATS fixture for the
shared contract; the fixture stays exported so the fixed-data adapter can still
serve the account domain as a rollback path.

Implements openspec change add-customer-accounts.

apps/api/tests/common/mod.rs

@@ -6,6 +6,7 @@ pub const TEST_REDIS_URL: &str = "redis://127.0.0.1:6379/";
 pub struct TestApp {
     pub base: String,
     pub db: sqlx::PgPool,
+    pub state: vmall_api::state::AppState,
 }
 
 impl TestApp {
@@ -42,7 +43,8 @@ pub async fn spawn_app() -> TestApp {
     });
     TestApp {
         base: format!("http://127.0.0.1:{port}"),
-        db: state.db,
+        db: state.db.clone(),
+        state,
     }
 }