feat(api): points mall with atomic redemption and admin fulfillment

Platform-owned points products and a redemption order lifecycle kept separate
from cash orders. Redeeming locks the published product, reserves stock, creates
the order, debits points through the archived customer-accounts ledger with the
order as reference, and snapshots the line in one transaction; a failure leaves
no order, no stock change, and no ledger entry. Fulfilment moves only from
pending_fulfillment, and customers see only their own redemptions.

Demo seeding credits the demo customer through the same guarded credit path
with reason seed, once, so no balance is ever written absolutely.

Surfaces (admin console, mall points page) and product seeding follow.

openspec/changes/add-points-mall/tasks.md

@@ -1,13 +1,13 @@
 ## 1. Prerequisite and persistence
 
-- [ ] 1.1 Confirm `customer-accounts` is archived and use its guarded internal points-debit service.
-- [ ] 1.2 Add additive migrations for platform points products, redemption orders, redemption items, status constraints, address snapshots, and indexes.
-- [ ] 1.3 Implement the Rust points module repositories and services for published catalog reads, admin product management, atomic redemption, history, and validated fulfillment transitions.
+- [x] 1.1 Confirm `customer-accounts` is archived and use its guarded internal points-debit service.
+- [x] 1.2 Add additive migrations for platform points products, redemption orders, redemption items, status constraints, address snapshots, and indexes.
+- [x] 1.3 Implement the Rust points module repositories and services for published catalog reads, admin product management, atomic redemption, history, and validated fulfillment transitions.
 
 ## 2. Contract and backend proof
 
 - [ ] 2.1 Register customer and platform routes with appropriate roles and add shared types, client methods, locales, and fixed-data adapter parity.
-- [ ] 2.2 Add integration tests for unpublished-product rejection, insufficient points rollback, concurrent final stock, ownership filtering, and fulfillment transition validation.
+- [x] 2.2 Add integration tests for unpublished-product rejection, insufficient points rollback, concurrent final stock, ownership filtering, and fulfillment transition validation.
 
 ## 3. Application surfaces
 
@@ -18,4 +18,4 @@
 ## 4. Verification and specification
 
 - [ ] 4.1 Seed deterministic points products and credit demo customer points through the archived customer-accounts credit path (append-only entry, never an absolute balance write). Browser-smoke admin publication and customer redemption.
-- [ ] 4.2 Run cargo test for vmall-api, builds for mall and admin, and strict validation for this OpenSpec change.
+- [ ] 4.2 Run cargo test for vmall-api, builds for mall and admin, and strict validation for this OpenSpec change.