feat: wave 2 migration (P3, P5, P7 openspec changes)

Implements, verifies, and archives the three remaining Wave 2 changes from
openspec/MIGRATION-PLAN.md.

- add-wallet-settlement (P3): demo recharge, guarded withdrawal freeze and
  one-time admin review, paginated own fund entries, idempotent per-shop
  weekly/monthly settlement statements with commission rate and one-time
  payout confirmation.
- add-merchant-onboarding (P5): personal/enterprise applications with one live
  application per user, guarded review with mandatory rejection reason, and
  transactional shop + owner provisioning returning one-time credentials;
  mall onboarding/status pages and an admin review console.
- add-membership-messaging (P7): platform member levels, append-only growth
  accrual on order completion with guarded one-way leveling, order/shipment/
  refund system messages with unread/read state and soft deletion, plus the
  mall header unread badge.

Backend: migrations 0019-0023, new wallet, settlement, merchant_onboarding,
membership and messaging modules, event hooks in order/fulfillment/aftersale,
and integration suites for each. Shared contract extended and all three
frontends updated; code indexes, domain docs, backend guidelines and the
migration tracker synced.

Verification: cargo test -p vmall-api green twice consecutively; mall, admin
and shop-admin builds pass; browser smoke on every new surface; openspec
validate --all --strict green (33 passed).

The three changes share the @vmall/shared contract, the mall mock adapter and
per-app locale/nav files, so they are committed together to keep every commit
buildable.

README.md

@@ -75,7 +75,14 @@ openspec validate --all --strict      # 规范校验
 
 `apps/mall` 通过 `apps/mall/plugins/api.ts` 的 `liveDomains` 按域选择适配器。当前真实后端域包括
 catalog、currency、content、brands、shops、auth、account、cart、orders、shipments、invoices、
-addresses、coupons、points、flashSales、groupBuying、favorites。
+addresses、coupons、points、flashSales、groupBuying、favorites、aftersales、reviews、wallet、
+merchantOnboarding、membership、messaging。
+
+`merchantOnboarding` 是商家入驻域：只有 `submitMerchantApplication` 与
+`getMyMerchantApplications` 两个方法走真实后端（admin 侧审核方法由 `apps/admin` 直接调用，
+mall 不使用）；把该域从 `liveDomains` 移除即回落到 `apps/mall/mock/api.ts` 的确定性 fixture。
+`membership`（`getMembership`/`listGrowthLogs`）与 `messaging`（消息列表、已读、全部已读、删除、
+未读数）同理各自独立可回滚；`messaging` 的未读数由页头徽标消费。
 
 仍由页面直接读取 `~/mock/data` 的能力记录在 `docs/TBD-marketing.md`。营销 fixture 仍由
 fixed-data 适配器使用，作为每个已迁移域的回滚实现。