feat: wave 2 migration (P3, P5, P7 openspec changes)

Implements, verifies, and archives the three remaining Wave 2 changes from
openspec/MIGRATION-PLAN.md.

- add-wallet-settlement (P3): demo recharge, guarded withdrawal freeze and
  one-time admin review, paginated own fund entries, idempotent per-shop
  weekly/monthly settlement statements with commission rate and one-time
  payout confirmation.
- add-merchant-onboarding (P5): personal/enterprise applications with one live
  application per user, guarded review with mandatory rejection reason, and
  transactional shop + owner provisioning returning one-time credentials;
  mall onboarding/status pages and an admin review console.
- add-membership-messaging (P7): platform member levels, append-only growth
  accrual on order completion with guarded one-way leveling, order/shipment/
  refund system messages with unread/read state and soft deletion, plus the
  mall header unread badge.

Backend: migrations 0019-0023, new wallet, settlement, merchant_onboarding,
membership and messaging modules, event hooks in order/fulfillment/aftersale,
and integration suites for each. Shared contract extended and all three
frontends updated; code indexes, domain docs, backend guidelines and the
migration tracker synced.

Verification: cargo test -p vmall-api green twice consecutively; mall, admin
and shop-admin builds pass; browser smoke on every new surface; openspec
validate --all --strict green (33 passed).

The three changes share the @vmall/shared contract, the mall mock adapter and
per-app locale/nav files, so they are committed together to keep every commit
buildable.

docs/code_index/mall.md

@@ -12,10 +12,16 @@ Guidelines: `docs/frontend-guidelines.md`.
 | `pages/search.vue`, `pages/goods/[id].vue` | catalog browsing; goods detail has reviews tab |
 | `pages/cart.vue`, `pages/checkout/*` | cart and checkout (address → quote → submit → pay → success) |
 | `pages/stores/*` | store directory + store detail |
-| `pages/user/*` | buyer center: orders, aftersales, reviews, coupons, addresses, invoices, favorites |
+| `pages/user/*` | buyer center: orders, aftersales, reviews, coupons, addresses, invoices, favorites, wallet |
+| `pages/user/wallet.vue` | wallet balances, paginated ledger entries, demo recharge, withdrawal request/history |
+| `pages/user/membership.vue` | level/benefits, growth total, progress to the next threshold, growth history |
+| `pages/user/messages.vue` | system message center: unread filter, mark read, mark-all-read, soft delete |
+| `pages/merchant/join.vue` | 商家入驻 multi-step application form (anonymous fill, sign-in gate, draft return) |
+| `pages/merchant/status.vue` | applicant's own application status, rejection reason, re-apply |
+| `locales/<domain>.ts` + `locales-extra.ts` | app-local bilingual strings deep-merged over the shared locales (mall namespaces: shell/home/search/product/cart/checkout/auth/user/stores/marketing/wallet/merchant/membership/messaging) |
 | `pages/seckill.vue`, `collective.vue`, `integral.vue` | flash sale, group buying, points mall |
-| `app.vue` + `components/shell/*` | header/footer shell |
-| `composables/` | session/cart stores, `usePrice` (currency conversion display) |
+| `app.vue` + `components/shell/*` | header/footer shell; `SiteHeader.vue` carries the unread-message badge |
+| `composables/` | session/cart stores, `usePrice` (currency conversion display), `useUnreadMessages` (header badge count) |
 
 Remember: mall is the only app with a mock adapter; every new live domain
 needs mock parity so `NUXT_PUBLIC_LIVE_DOMAINS` rollback keeps working.