feat: wave 2 migration (P3, P5, P7 openspec changes)

Implements, verifies, and archives the three remaining Wave 2 changes from
openspec/MIGRATION-PLAN.md.

- add-wallet-settlement (P3): demo recharge, guarded withdrawal freeze and
  one-time admin review, paginated own fund entries, idempotent per-shop
  weekly/monthly settlement statements with commission rate and one-time
  payout confirmation.
- add-merchant-onboarding (P5): personal/enterprise applications with one live
  application per user, guarded review with mandatory rejection reason, and
  transactional shop + owner provisioning returning one-time credentials;
  mall onboarding/status pages and an admin review console.
- add-membership-messaging (P7): platform member levels, append-only growth
  accrual on order completion with guarded one-way leveling, order/shipment/
  refund system messages with unread/read state and soft deletion, plus the
  mall header unread badge.

Backend: migrations 0019-0023, new wallet, settlement, merchant_onboarding,
membership and messaging modules, event hooks in order/fulfillment/aftersale,
and integration suites for each. Shared contract extended and all three
frontends updated; code indexes, domain docs, backend guidelines and the
migration tracker synced.

Verification: cargo test -p vmall-api green twice consecutively; mall, admin
and shop-admin builds pass; browser smoke on every new surface; openspec
validate --all --strict green (33 passed).

The three changes share the @vmall/shared contract, the mall mock adapter and
per-app locale/nav files, so they are committed together to keep every commit
buildable.

apps/mall/plugins/api.ts

@@ -26,7 +26,11 @@ type LiveDomain =
   | "groupBuying"
   | "favorites"
   | "aftersales"
-  | "reviews";
+  | "reviews"
+  | "wallet"
+  | "membership"
+  | "messaging"
+  | "merchantOnboarding";
 
 /**
  * Explicit per-domain method picks rather than a string allowlist: indexing
@@ -111,6 +115,28 @@ const LIVE_PICKS = {
     listReviewableItems: a.listReviewableItems,
     createReview: a.createReview,
   }),
+  wallet: (a: ApiClient) => ({
+    getWallet: a.getWallet,
+    listWalletEntries: a.listWalletEntries,
+    rechargeWallet: a.rechargeWallet,
+    applyWithdrawal: a.applyWithdrawal,
+    listMyWithdrawals: a.listMyWithdrawals,
+  }),
+  membership: (a: ApiClient) => ({
+    getMembership: a.getMembership,
+    listGrowthLogs: a.listGrowthLogs,
+  }),
+  messaging: (a: ApiClient) => ({
+    listMessages: a.listMessages,
+    markMessageRead: a.markMessageRead,
+    markAllMessagesRead: a.markAllMessagesRead,
+    deleteMessage: a.deleteMessage,
+    getUnreadCount: a.getUnreadCount,
+  }),
+  merchantOnboarding: (a: ApiClient) => ({
+    submitMerchantApplication: a.submitMerchantApplication,
+    getMyMerchantApplications: a.getMyMerchantApplications,
+  }),
 } satisfies Record<LiveDomain, (a: ApiClient) => Partial<ApiClient>>;
 
 const KNOWN_DOMAINS = Object.keys(LIVE_PICKS) as LiveDomain[];
@@ -136,6 +162,10 @@ const DEFAULT_LIVE_DOMAINS: LiveDomain[] = [
   "favorites",
   "aftersales",
   "reviews",
+  "wallet",
+  "membership",
+  "messaging",
+  "merchantOnboarding",
 ];
 
 export default defineNuxtPlugin(() => {