feat: wave 2 migration (P3, P5, P7 openspec changes)

Implements, verifies, and archives the three remaining Wave 2 changes from
openspec/MIGRATION-PLAN.md.

- add-wallet-settlement (P3): demo recharge, guarded withdrawal freeze and
  one-time admin review, paginated own fund entries, idempotent per-shop
  weekly/monthly settlement statements with commission rate and one-time
  payout confirmation.
- add-merchant-onboarding (P5): personal/enterprise applications with one live
  application per user, guarded review with mandatory rejection reason, and
  transactional shop + owner provisioning returning one-time credentials;
  mall onboarding/status pages and an admin review console.
- add-membership-messaging (P7): platform member levels, append-only growth
  accrual on order completion with guarded one-way leveling, order/shipment/
  refund system messages with unread/read state and soft deletion, plus the
  mall header unread badge.

Backend: migrations 0019-0023, new wallet, settlement, merchant_onboarding,
membership and messaging modules, event hooks in order/fulfillment/aftersale,
and integration suites for each. Shared contract extended and all three
frontends updated; code indexes, domain docs, backend guidelines and the
migration tracker synced.

Verification: cargo test -p vmall-api green twice consecutively; mall, admin
and shop-admin builds pass; browser smoke on every new surface; openspec
validate --all --strict green (33 passed).

The three changes share the @vmall/shared contract, the mall mock adapter and
per-app locale/nav files, so they are committed together to keep every commit
buildable.

docs/code_index/consoles.md

@@ -17,6 +17,8 @@ per page. Navigation is a static list in each `app.vue`.
 | `pages/invoices.vue` | invoice issuing |
 | `pages/freight-templates.vue` | freight templates + region rules |
 | `pages/shop-profile.vue` | own shop profile self-edit |
+| `pages/settlements.vue` | own-shop statements: list/detail, idempotent generation |
+| `pages/shop-account.vue` | shop-owner wallet summary, withdrawal request/history, fund entries |
 
 ## apps/admin (platform console, :3002)
 
@@ -30,3 +32,7 @@ per page. Navigation is a static list in each `app.vue`.
 | `pages/content.vue`, `pages/brands.vue` | storefront content, brand registry |
 | `pages/currencies.vue` | currency registry + rates |
 | `pages/points-products.vue`, `pages/points-orders.vue` | points mall ops |
+| `pages/withdrawals.vue` | withdrawal review queue (approve/reject once, 409 feedback) |
+| `pages/settlements.vue` | commission rate, statement list/detail, idempotent generation, one-time payout confirmation |
+| `pages/merchant-applications.vue` | merchant application review queue, detail, approve/reject, one-time owner credentials |
+| `pages/member-levels.vue` + `components/MemberLevelForm.vue` | member level catalog CRUD (bilingual, unique threshold, in-use delete rejection) |

docs/code_index/index.md

@@ -10,7 +10,7 @@ files it lists.**
 | Post-order | aftersales/refunds, reviews | [code_index/post-order.md](post-order.md) |
 | Catalog | products, SKUs, categories, brands | [code_index/catalog.md](catalog.md) |
 | Marketing | coupons, flash sales, group buying, points | [code_index/marketing.md](marketing.md) |
-| Platform | identity, accounts/ledger, shops, storefront content, currencies, addresses | [code_index/platform.md](platform.md) |
+| Platform | identity, accounts/ledger, wallet, settlement, merchant onboarding, membership & messages, shops, storefront content, currencies, addresses | [code_index/platform.md](platform.md) |
 | Shared contract | types, API client, locales, UI components | [code_index/shared.md](shared.md) |
 | Storefront app | mall pages, mock adapter, live-domain wiring | [code_index/mall.md](mall.md) |
 | Console apps | shop-admin, admin pages | [code_index/consoles.md](consoles.md) |

docs/code_index/mall.md

@@ -12,10 +12,16 @@ Guidelines: `docs/frontend-guidelines.md`.
 | `pages/search.vue`, `pages/goods/[id].vue` | catalog browsing; goods detail has reviews tab |
 | `pages/cart.vue`, `pages/checkout/*` | cart and checkout (address → quote → submit → pay → success) |
 | `pages/stores/*` | store directory + store detail |
-| `pages/user/*` | buyer center: orders, aftersales, reviews, coupons, addresses, invoices, favorites |
+| `pages/user/*` | buyer center: orders, aftersales, reviews, coupons, addresses, invoices, favorites, wallet |
+| `pages/user/wallet.vue` | wallet balances, paginated ledger entries, demo recharge, withdrawal request/history |
+| `pages/user/membership.vue` | level/benefits, growth total, progress to the next threshold, growth history |
+| `pages/user/messages.vue` | system message center: unread filter, mark read, mark-all-read, soft delete |
+| `pages/merchant/join.vue` | 商家入驻 multi-step application form (anonymous fill, sign-in gate, draft return) |
+| `pages/merchant/status.vue` | applicant's own application status, rejection reason, re-apply |
+| `locales/<domain>.ts` + `locales-extra.ts` | app-local bilingual strings deep-merged over the shared locales (mall namespaces: shell/home/search/product/cart/checkout/auth/user/stores/marketing/wallet/merchant/membership/messaging) |
 | `pages/seckill.vue`, `collective.vue`, `integral.vue` | flash sale, group buying, points mall |
-| `app.vue` + `components/shell/*` | header/footer shell |
-| `composables/` | session/cart stores, `usePrice` (currency conversion display) |
+| `app.vue` + `components/shell/*` | header/footer shell; `SiteHeader.vue` carries the unread-message badge |
+| `composables/` | session/cart stores, `usePrice` (currency conversion display), `useUnreadMessages` (header badge count) |
 
 Remember: mall is the only app with a mock adapter; every new live domain
 needs mock parity so `NUXT_PUBLIC_LIVE_DOMAINS` rollback keeps working.

docs/code_index/platform.md

@@ -1,8 +1,9 @@
 # Index: Platform (identity, accounts, shops, content, currency, addresses)
 
 Domain design: `docs/domains/platform.md`. Specs: `openspec/specs/auth/`,
-`customer-accounts/`, `store-directory/`, `storefront-content/`, `currency/`,
-`address-book/`, `rbac/`.
+`customer-accounts/`, `wallet/`, `settlement/`, `merchant-onboarding/`,
+`membership/`, `messaging/`, `store-directory/`, `storefront-content/`,
+`currency/`, `address-book/`, `rbac/`.
 
 ## Backend (`apps/api`)
 
@@ -10,7 +11,12 @@ Domain design: `docs/domains/platform.md`. Specs: `openspec/specs/auth/`,
 |---|---|
 | `modules/identity/` | register/login/me; admin user role assignment |
 | `modules/account/` | customer_accounts ledger; credit/debit/freeze/release, `ensure_monetary_account` |
+| `modules/wallet/` | demo recharge, guarded withdrawal freeze + one-time admin review, paginated own fund entries |
+| `modules/settlement/` | idempotent per-shop weekly/monthly statements, commission-rate setting, one-time payout confirmation |
 | `modules/shop/` | shop CRUD/status, profiles, `PUT /shop/profile` merchant self-write |
+| `modules/merchant_onboarding/` | merchant applications (personal/enterprise), guarded review, transactional approval provisioning |
+| `modules/membership/` | member level catalog, growth accrual ledger, one-way level upgrade, derived status |
+| `modules/messaging/` | event-driven system messages, unread/read state, soft delete, unread count |
 | `modules/content/` | four home-content kinds, whole-list replacement |
 | `modules/currency/` | currency registry, rates, `convert` endpoint |
 | `modules/address/` | customer address book |
@@ -18,8 +24,10 @@ Domain design: `docs/domains/platform.md`. Specs: `openspec/specs/auth/`,
 | `src/error.rs` | `ApiError` envelope, `unique_conflict` |
 | `src/money.rs` | `convert_minor` |
 
-Tests: `tests/auth.rs`, `tests/accounts.rs`, `tests/shops.rs`,
-`tests/content.rs`, `tests/addresses.rs`, `tests/catalog.rs` (currency too).
+Tests: `tests/auth.rs`, `tests/accounts.rs`, `tests/wallet.rs`,
+`tests/settlement.rs`, `tests/merchant_applications.rs`, `tests/membership.rs`,
+`tests/messaging.rs`, `tests/shops.rs`, `tests/content.rs`,
+`tests/addresses.rs`, `tests/catalog.rs` (currency too).
 
 ## Frontends
 
@@ -27,4 +35,4 @@ Tests: `tests/auth.rs`, `tests/accounts.rs`, `tests/shops.rs`,
   `layouts/`/`app.vue`, `pages/user/addresses.vue`
 - Shop-admin: `pages/shop-profile.vue`
 - Admin: `pages/users.vue`, `pages/shops.vue`, `pages/content.vue`,
-  `pages/brands.vue`, `pages/currencies.vue`
+  `pages/brands.vue`, `pages/currencies.vue`, `pages/member-levels.vue`