feat: wave 2 migration (P3, P5, P7 openspec changes)

Implements, verifies, and archives the three remaining Wave 2 changes from
openspec/MIGRATION-PLAN.md.

- add-wallet-settlement (P3): demo recharge, guarded withdrawal freeze and
  one-time admin review, paginated own fund entries, idempotent per-shop
  weekly/monthly settlement statements with commission rate and one-time
  payout confirmation.
- add-merchant-onboarding (P5): personal/enterprise applications with one live
  application per user, guarded review with mandatory rejection reason, and
  transactional shop + owner provisioning returning one-time credentials;
  mall onboarding/status pages and an admin review console.
- add-membership-messaging (P7): platform member levels, append-only growth
  accrual on order completion with guarded one-way leveling, order/shipment/
  refund system messages with unread/read state and soft deletion, plus the
  mall header unread badge.

Backend: migrations 0019-0023, new wallet, settlement, merchant_onboarding,
membership and messaging modules, event hooks in order/fulfillment/aftersale,
and integration suites for each. Shared contract extended and all three
frontends updated; code indexes, domain docs, backend guidelines and the
migration tracker synced.

Verification: cargo test -p vmall-api green twice consecutively; mall, admin
and shop-admin builds pass; browser smoke on every new surface; openspec
validate --all --strict green (33 passed).

The three changes share the @vmall/shared contract, the mall mock adapter and
per-app locale/nav files, so they are committed together to keep every commit
buildable.

apps/mall/composables/useUnreadMessages.ts

@@ -0,0 +1,30 @@
+/**
+ * The signed-in shopper's unread message count, shared between the shell badge
+ * and the message center. Every read/mark-all/delete action refreshes the count
+ * through `$api.getUnreadCount()` so the badge never drifts from the server.
+ */
+export function useUnreadMessages() {
+  const { $api } = useNuxtApp();
+  const session = useSessionStore();
+  const unread = useState<number>("unread-messages", () => 0);
+
+  /** Anonymous shoppers have no message center, so the count stays at zero. */
+  async function refresh(): Promise<void> {
+    if (!session.isLoggedIn) {
+      unread.value = 0;
+      return;
+    }
+    try {
+      unread.value = (await $api.getUnreadCount()).unread;
+    } catch {
+      unread.value = 0;
+    }
+  }
+
+  /** Let a mutating page push the authoritative number without a second call. */
+  function setCount(count: number): void {
+    unread.value = Math.max(0, count);
+  }
+
+  return { unread, refresh, setCount };
+}