feat(mall): restore real brand and sales facets

Wave 6, the last substantive piece of the mock-API migration. Wave 1 removed the
brand facet and the sales/comments sorts for want of a model; sales turn out to
be derivable from order_items and a brand model is a table plus a column.

- a `brands` table with a nullable `products.brand_id` and an ordered admin
  replace, mirroring categories and storefront content; a public `GET /api/brands`
  and a `brand_id` filter on the catalog, which the search page's facet uses
- `sold_count` per product, computed from `order_items` joined to orders that
  reached payment, so an abandoned or cancelled checkout cannot count as a sale.
  It is computed per read rather than stored, so it cannot drift from the orders
  that produced it
- `sort=sales` alongside `sort=price`; anything else is still a 400
- merchants can set a product's brand through the existing product upsert
- the review UI is gone: the card's review figure and the product detail page's
  reviews tab, summary and replies. There is no reviews model, and the mall
  attributed invented comments to named shoppers and showed a "good rate". The
  now-unreferenced fabrication helpers went with it (`salesOf`, `commentCountOf`,
  `commentsFor`, `commentStats`, `salesRankFor`, `productDetail`, `storeDetail`)

Two bugs found by checking rather than trusting: the fixed-data `listProducts`
had silently ignored `brand_id`, `sort` and `order`, so the restored facet
rendered but filtered nothing until the rollback check caught it; and the seed's
brand lookup read back through the shared `r` variable the product loop
reassigns, working once and then throwing.

Verified: 29 backend tests green including a new brand-and-sales case; all three
frontends build; searching filters by brand (24 to 6) and sorts by sales with
counts matching the API; a product page offers detail and after-sale tabs only,
with a real sold count; the fixed-data rollback filters by brand too.

OpenSpec change: openspec/changes/replace-mock-api-wave-6

apps/api/tests/common/mod.rs

@@ -150,7 +150,7 @@ pub async fn create_product_with_sku(
     price_minor: i64,
     stock: i32,
 ) -> (String, String) {
-    create_product_with_sku_in_category(app, owner_token, slug, price_minor, stock, None).await
+    create_product_full(app, owner_token, slug, price_minor, stock, None, None).await
 }
 
 /// Same, but placed in `category_id` so category filtering can be exercised.
@@ -161,6 +161,19 @@ pub async fn create_product_with_sku_in_category(
     price_minor: i64,
     stock: i32,
     category_id: Option<&str>,
+) -> (String, String) {
+    create_product_full(app, owner_token, slug, price_minor, stock, category_id, None).await
+}
+
+/// Same, with a category and a brand so both filters can be exercised.
+pub async fn create_product_full(
+    app: &TestApp,
+    owner_token: &str,
+    slug: &str,
+    price_minor: i64,
+    stock: i32,
+    category_id: Option<&str>,
+    brand_id: Option<&str>,
 ) -> (String, String) {
     let slug = format!("{slug}-{}", &uuid::Uuid::new_v4().simple().to_string()[..8]);
     let res = client()
@@ -171,6 +184,7 @@ pub async fn create_product_with_sku_in_category(
             "name": {"en": format!("Product {slug}"), "zh": format!("商品 {slug}")},
             "description": {"en": "desc en", "zh": "描述"},
             "category_id": category_id,
+            "brand_id": brand_id,
         }))
         .send()
         .await