feat: wave 2 migration (P3, P5, P7 openspec changes)

Implements, verifies, and archives the three remaining Wave 2 changes from
openspec/MIGRATION-PLAN.md.

- add-wallet-settlement (P3): demo recharge, guarded withdrawal freeze and
  one-time admin review, paginated own fund entries, idempotent per-shop
  weekly/monthly settlement statements with commission rate and one-time
  payout confirmation.
- add-merchant-onboarding (P5): personal/enterprise applications with one live
  application per user, guarded review with mandatory rejection reason, and
  transactional shop + owner provisioning returning one-time credentials;
  mall onboarding/status pages and an admin review console.
- add-membership-messaging (P7): platform member levels, append-only growth
  accrual on order completion with guarded one-way leveling, order/shipment/
  refund system messages with unread/read state and soft deletion, plus the
  mall header unread badge.

Backend: migrations 0019-0023, new wallet, settlement, merchant_onboarding,
membership and messaging modules, event hooks in order/fulfillment/aftersale,
and integration suites for each. Shared contract extended and all three
frontends updated; code indexes, domain docs, backend guidelines and the
migration tracker synced.

Verification: cargo test -p vmall-api green twice consecutively; mall, admin
and shop-admin builds pass; browser smoke on every new surface; openspec
validate --all --strict green (33 passed).

The three changes share the @vmall/shared contract, the mall mock adapter and
per-app locale/nav files, so they are committed together to keep every commit
buildable.

apps/mall/pages/login.vue

@@ -24,6 +24,12 @@ const redirectTarget = computed((): string => {
     : "/";
 });
 
+/** Carry the return path into registration so both entry points return here. */
+const registerLink = computed(() => ({
+  path: "/register",
+  query: redirectTarget.value === "/" ? {} : { redirect: redirectTarget.value },
+}));
+
 function validate(): boolean {
   if (!email.value || !password.value) {
     errorKey.value = "auth.validationRequired";
@@ -62,7 +68,7 @@ async function submit(): Promise<void> {
     <VCard class="mx-auto my-10 max-w-[420px] p-6 sm:p-10">
       <div class="border-border mb-7 flex items-baseline gap-4 border-b pb-3.5">
         <h1 class="m-0 text-xl font-semibold">{{ t("auth.loginTab") }}</h1>
-        <NuxtLink class="text-primary hover:text-primary-hover text-sm" to="/register">{{
+        <NuxtLink class="text-primary hover:text-primary-hover text-sm" :to="registerLink">{{
           t("auth.registerTab")
         }}</NuxtLink>
       </div>
@@ -90,7 +96,7 @@ async function submit(): Promise<void> {
       </form>
       <div class="text-muted mt-5 flex flex-wrap items-center gap-2 text-xs">
         <span>{{ t("auth.noAccount") }}</span>
-        <NuxtLink class="text-primary hover:text-primary-hover" to="/register">{{
+        <NuxtLink class="text-primary hover:text-primary-hover" :to="registerLink">{{
           t("auth.registerNow")
         }}</NuxtLink>
         <NuxtLink class="text-primary hover:text-primary-hover" to="/forgot-password">{{