feat: wave 2 migration (P3, P5, P7 openspec changes)

Implements, verifies, and archives the three remaining Wave 2 changes from
openspec/MIGRATION-PLAN.md.

- add-wallet-settlement (P3): demo recharge, guarded withdrawal freeze and
  one-time admin review, paginated own fund entries, idempotent per-shop
  weekly/monthly settlement statements with commission rate and one-time
  payout confirmation.
- add-merchant-onboarding (P5): personal/enterprise applications with one live
  application per user, guarded review with mandatory rejection reason, and
  transactional shop + owner provisioning returning one-time credentials;
  mall onboarding/status pages and an admin review console.
- add-membership-messaging (P7): platform member levels, append-only growth
  accrual on order completion with guarded one-way leveling, order/shipment/
  refund system messages with unread/read state and soft deletion, plus the
  mall header unread badge.

Backend: migrations 0019-0023, new wallet, settlement, merchant_onboarding,
membership and messaging modules, event hooks in order/fulfillment/aftersale,
and integration suites for each. Shared contract extended and all three
frontends updated; code indexes, domain docs, backend guidelines and the
migration tracker synced.

Verification: cargo test -p vmall-api green twice consecutively; mall, admin
and shop-admin builds pass; browser smoke on every new surface; openspec
validate --all --strict green (33 passed).

The three changes share the @vmall/shared contract, the mall mock adapter and
per-app locale/nav files, so they are committed together to keep every commit
buildable.

apps/api/migrations/0023_membership_messaging.sql

@@ -0,0 +1,73 @@
+-- Membership: platform-managed levels, an append-only growth ledger, and the
+-- customer's current level on `users`. Messaging: per-customer system messages
+-- emitted by order/shipment/refund events with unread state and soft deletion.
+
+CREATE TABLE member_levels (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    name JSONB NOT NULL,
+    icon TEXT NOT NULL,
+    growth_threshold BIGINT NOT NULL CHECK (growth_threshold >= 0),
+    benefits JSONB NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    CONSTRAINT member_levels_icon CHECK (btrim(icon) <> '')
+);
+
+-- Thresholds are unique; level order follows the threshold.
+CREATE UNIQUE INDEX member_levels_threshold_idx ON member_levels (growth_threshold);
+
+ALTER TABLE users ADD COLUMN level UUID REFERENCES member_levels (id);
+CREATE INDEX users_level_idx ON users (level);
+
+CREATE TABLE growth_logs (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id UUID NOT NULL REFERENCES users (id) ON DELETE CASCADE,
+    -- Growth value in whole base-currency units; 0 only for sub-unit orders.
+    delta BIGINT NOT NULL CHECK (delta >= 0),
+    growth_total BIGINT NOT NULL CHECK (growth_total >= 0),
+    reason TEXT NOT NULL,
+    reference_type TEXT,
+    reference_id UUID,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- One accrual per user and referenced order, so a retried completion is a no-op.
+CREATE UNIQUE INDEX growth_logs_reference_idx
+    ON growth_logs (user_id, reference_type, reference_id)
+    WHERE reference_id IS NOT NULL;
+CREATE INDEX growth_logs_user_idx
+    ON growth_logs (user_id, created_at DESC, id DESC);
+
+CREATE TYPE message_kind AS ENUM ('order_paid', 'order_shipped', 'refund_completed');
+CREATE TYPE message_status AS ENUM ('unread', 'read');
+
+CREATE TABLE messages (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id UUID NOT NULL REFERENCES users (id) ON DELETE CASCADE,
+    kind message_kind NOT NULL,
+    title JSONB NOT NULL,
+    body JSONB NOT NULL,
+    reference_type TEXT,
+    reference_id UUID,
+    status message_status NOT NULL DEFAULT 'unread',
+    read_at TIMESTAMPTZ,
+    deleted_at TIMESTAMPTZ,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    CONSTRAINT messages_read_consistent CHECK (
+        (status = 'unread' AND read_at IS NULL)
+        OR (status = 'read' AND read_at IS NOT NULL)
+    )
+);
+
+-- One message per customer, kind, and reference: re-running an event handler
+-- conflicts instead of duplicating. Soft-deleted rows still occupy the slot so
+-- a re-run cannot resurrect a deleted message as a new one.
+CREATE UNIQUE INDEX messages_event_idx
+    ON messages (user_id, kind, reference_type, reference_id)
+    WHERE reference_id IS NOT NULL;
+CREATE INDEX messages_user_idx
+    ON messages (user_id, created_at DESC, id DESC)
+    WHERE deleted_at IS NULL;
+CREATE INDEX messages_unread_idx
+    ON messages (user_id)
+    WHERE deleted_at IS NULL AND status = 'unread';