## Why

The order lifecycle currently stops after confirmation of delivery. Without a per-line after-sale and refund path, a paid order has no marketplace-safe recovery when goods or fulfillment fail. This is a baseline commerce gap, not an optional enhancement.

## What Changes

- Add customer-owned refund-only and return-refund applications for paid or shipped order items, with localized reasons, integer minor-unit amounts, and evidence URLs.
- Add guarded merchant decisions, buyer return tracking, bilateral messages, one-time rejected appeals, and optional platform arbitration.
- Credit completed refunds to `customer_accounts` through the existing append-only ledger and aggregate refunded order totals without a real payment gateway.
- Expose the flow in Mall, shop-admin, and platform-admin while preserving a deterministic Mall mock adapter and `LIVE_PICKS` wiring.

## Capabilities

### New Capabilities
- `aftersale`: Per-order-item applications, state transitions, messages, arbitration, and ledger-backed refund completion.

### Modified Capabilities
- `order`: After-sale eligibility windows, per-line refundable amounts, and authoritative refund totals.
- `frontend-mall`: Customer after-sale application, tracking, messages, and history surfaces.
- `frontend-shop-admin`: Shop-scoped after-sale processing workspace.
- `frontend-admin`: Platform read-only monitoring and dispute arbitration.

## Non-goals

Real payment-channel refunds, exchanges, reshipments, shipping insurance, and IM negotiation are excluded; messages replace live negotiation.

## Impact

Adds one after-sale migration, shared API contracts, Rust module and integration coverage, customer and console pages, fixed-adapter parity, and account-ledger/order-total integration.