feat(api): add customer accounts with live summary and append-only ledger

One balance row per (user, kind, currency): available and frozen carry the
platform base currency, points carries none. Monetary and points rows use
separate partial unique indexes because a plain UNIQUE lets NULL repeat.

Balance changes go through transactional primitives that debits guard with a
conditional update, credits add atomically, and freeze/release move both sides
in one transaction after locking rows by primary key. Every change appends an
immutable entry holding its resulting balance. Registration and a migration
backfill create the zero rows; GET /api/me/stats is the only public surface and
no endpoint mutates a balance.

The mall buyer center and points page drop the USER_STATS fixture for the
shared contract; the fixture stays exported so the fixed-data adapter can still
serve the account domain as a rollback path.

Implements openspec change add-customer-accounts.

packages/shared/src/api.ts

@@ -1,4 +1,5 @@
 import type {
+  AccountSummary,
   Address,
   AddressBookEntry,
   AuthTokens,
@@ -151,6 +152,8 @@ export interface ApiClient {
   register(email: string, password: string, displayName: string): Promise<AuthTokens>;
   login(email: string, password: string): Promise<AuthTokens>;
   me(): Promise<User>;
+  /** The signed-in customer's own money and points balances. */
+  getAccountSummary(): Promise<AccountSummary>;
   listProducts(q?: ProductListQuery): Promise<Paged<Product>>;
   getProduct(idOrSlug: string): Promise<Product>;
   listCategories(): Promise<Category[]>;
@@ -235,6 +238,7 @@ export function createApi(opts: ApiClientOptions): ApiClient {
       r("POST", "/auth/register", { email, password, display_name: displayName }),
     login: (email, password) => r("POST", "/auth/login", { email, password }),
     me: () => r("GET", "/auth/me"),
+    getAccountSummary: () => r("GET", "/me/stats"),
     listProducts: (q = {}) => r("GET", "/products", undefined, { ...q }),
     getProduct: (idOrSlug) => r("GET", `/products/${idOrSlug}`),
     listCategories: () => r("GET", "/categories"),