feat(shard): the player-vendor marketplace

Protocol 3.0 §8, the website half. Ingests vendor.listing / vendor.listing.remove
into shard_vendors + shard_vendor_items, serves a searchable public API over
them, and ships /site/market and /site/market/vendors/:serial.

Three things the pages have to say out loud, all consequences of how the data is
gathered:

- The prices are NOT live. The shard sweeps vendors round-robin, so a shop can be
  a full cycle behind. The banner is driven by the OLDEST vendor row, not the
  newest — the one stale shop is the one that wastes somebody's trip.
- A shop can be truncated. `total` exceeding `count` means the shop holds more
  than the shard publishes per frame; the vendor page says "showing 250 of 3,104"
  rather than presenting a partial shop as complete.
- An item may have no name. On a shard with no cliloc table the honest render is
  the item id, never an invented label.

## The pre-wired visibility rules, re-checked

Part A pre-wired market.ownerName and market.location before the frame existed,
and the sibling rule it pre-wired for leaderboards (`characterName`) turned out
to be INERT because projectValue matches literal JSON keys. Both market rules
were checked against the real frame this time:

- `ownerName` is a real key. Kept.
- `location` is a real key ONLY because the frame nests it. Flat map/x/y/region
  would have made the rule match nothing — the same failure, one part later. It
  is nested on the wire and on the read model so one rule hides the facet, the
  coordinates, the region and the house together; five flat keys would be five
  rules that drift apart.
- `ownerSerial` was ADDED. An admin who hides the owner's name and leaves a
  serial that the leaderboards and guild boards resolve back to that same name
  has not hidden anything.

Tests assert all three bite, on the stored read model AND on the raw frame —
the market's SSE stream is off by default but an admin can turn it on, and a rule
that worked on only one path is exactly the leak §3.6.1 records.

## Notable

- **No payload column on shard_vendors**, unlike shard_points_boards next door.
  The board's top-N is a fixed-size list read whole; here the items ARE the
  searchable rows, so they are normalized and nothing is left worth duplicating.
- **display_name is denormalized at ingest** (literal name preferred over the
  cliloc — a player set it, so it is more specific). Resolving at query time
  would put the cliloc table on the hot path and make search-by-name impossible.
  Because the shard's diff sweep will not re-send an unchanged shop just because
  the site learned what its items are called, a cliloc import now triggers a bulk
  re-resolution — 50 ms per thousand rows, never throws.
- **updated_at is written explicitly** on every upsert. MariaDB does not fire ON
  UPDATE CURRENT_TIMESTAMP when every column is written back unchanged, and a
  shop re-published identically is still freshly confirmed — without this the
  staleness banner would age a perfectly current shop forever.
- **LIKE wildcards in `q` are escaped.** `%` and `_` are LIKE metacharacters, not
  SQL ones, so parameterization does not neutralize them: `?q=%` would otherwise
  match every listing on the shard.
- **Rate-limited** (60/min/IP), the only limited public read. Every other public
  GET is an indexed lookup of bounded size; this is a LIKE scan plus a COUNT over
  the largest shard_* table, anonymous by default.
- Reconnect backfill pages /market, bounded by MARKET_SNAPSHOT_MAX = 5000 and
  stopping on a short page as well as on `total`, so a concurrent sweep shrinking
  the index cannot spin the walk.

## How it was tested

673 server tests pass (27 new). Client builds clean; swagger-output.json,
routes.manifest.json and routes.guards.json regenerated.

Verified full-stack against the live MariaDB and a real shard, not only units:

- 27 real vendors / 1,040 listings swept off the ServUO tree, through the Rust
  sidecar, into the site — names resolving through the cliloc table ("longsword",
  "katana"), real facets and regions in the filters.
- `?q=sword` 682, `?q=%` and `?q=_` **0** (the escape), map/region/price/sort
  filters, paging, and the vendor detail route.
- Visibility live: fields gated to staff vanish for an anonymous caller while
  shopName and price survive; audience=player 403s; enabled=0 404s; and
  /shard/features correctly drops `market` so the nav hides it.
- Re-publishing a shop smaller leaves no orphan items; an identical re-publish
  moves updated_at.
- The limiter fires (38x200 then 32x429 on a 70-request burst).

Not covered by an automated test: the two React pages are presentational and this
repo's client suite covers pure-logic modules only. They were driven against the
live API above, but not rendered in a DOM harness.

Co-Authored-By: Claude <noreply@anthropic.com>

server/src/router/v1/public/shard.controller.js

@@ -11,6 +11,7 @@
 
 const shardEvents = require('../../../model/shardEvents/shardEvents.model')
 const shardState = require('../../../model/shardState/shardState.model')
+const shardMarket = require('../../../model/shardMarket/shardMarket.model')
 const uoLinkConfig = require('../../../model/uoLinkConfig/uoLinkConfig.model')
 const broadcast = require('../../../utils/shardBroadcast')
 const visibility = require('../../../utils/shardVisibility')
@@ -299,6 +300,84 @@ async function getPointsBoard(req, res) {
   }
 }
 
+// ── Marketplace (Protocol 3.0 vendor.listing) ──────────────────────────────
+//
+// The shard-wide player-vendor index. Served entirely from our own tables — the
+// sidecar is never touched on this path — so shops stay browsable while the shard
+// is down, labelled with how stale they may be.
+//
+// The staleness label is not decoration. The shard sweeps vendors round-robin, so
+// a shop can legitimately be a full cycle behind; a page that implied live prices
+// would send people to a vendor whose item sold twenty minutes ago.
+
+// The serial spelling the bridge uses everywhere: "0x" and hex. Constrained
+// before it reaches the model, like SYSTEM_RE above.
+const SERIAL_RE = /^0x[0-9A-Fa-f]{1,16}$/
+
+const intParam = (value) => {
+  const n = Number.parseInt(value, 10)
+  return Number.isFinite(n) ? n : undefined
+}
+
+// GET /public/shard/market — search the index.
+//
+// Returns LISTINGS, not vendors: "who sells a vanquishing kryss and for how much"
+// is the question, and a vendor-shaped result would make every caller flatten the
+// shops back out.
+async function getMarket(req, res) {
+  try {
+    const page = await shardMarket.search({
+      q: typeof req.query.q === 'string' ? req.query.q : '',
+      minPrice: intParam(req.query.minPrice),
+      maxPrice: intParam(req.query.maxPrice),
+      itemId: intParam(req.query.itemId),
+      map: typeof req.query.map === 'string' ? req.query.map : '',
+      region: typeof req.query.region === 'string' ? req.query.region : '',
+      sort: typeof req.query.sort === 'string' ? req.query.sort : 'price_asc',
+      limit: intParam(req.query.limit) ?? 50,
+      offset: intParam(req.query.offset) ?? 0,
+    })
+    return res.json(await visibility.project('market', page, req))
+  } catch (err) {
+    log.error('shard.getMarket', err)
+    return res.status(500).json({ message: 'Internal Server Error' })
+  }
+}
+
+// GET /public/shard/market/meta — index size, staleness, and the filter options
+// (which facets and regions actually hold vendors). Separate from the search so
+// the page can build its filters without running a query it will throw away.
+async function getMarketMeta(req, res) {
+  try {
+    return res.json(await visibility.project('market', await shardMarket.meta(), req))
+  } catch (err) {
+    log.error('shard.getMarketMeta', err)
+    return res.status(500).json({ message: 'Internal Server Error' })
+  }
+}
+
+// GET /public/shard/market/vendors/:serial — one shop and its listings.
+//
+// 404 for a serial the index has never seen, which also covers a vendor that has
+// since been dismissed or hidden: to an anonymous caller "no such shop" is the
+// only honest answer, and distinguishing the two would leak that a vendor exists
+// but was hidden.
+async function getMarketVendor(req, res) {
+  const { serial } = req.params
+  if (!SERIAL_RE.test(serial)) return res.status(400).json({ message: 'Invalid vendor serial.' })
+  try {
+    const vendor = await shardMarket.getVendor(serial, {
+      limit: intParam(req.query.limit) ?? 250,
+      offset: intParam(req.query.offset) ?? 0,
+    })
+    if (!vendor) return res.status(404).json({ message: 'Unknown vendor.' })
+    return res.json(await visibility.project('market', vendor, req))
+  } catch (err) {
+    log.error('shard.getMarketVendor', err)
+    return res.status(500).json({ message: 'Internal Server Error' })
+  }
+}
+
 // GET /public/shard/features — the shard features THIS caller can actually see,
 // so the SPA (and the Android client) can hide nav entries instead of rendering
 // links that 403. Deliberately reports only what the viewer may reach: the list
@@ -335,6 +414,9 @@ module.exports = {
   getRuleset,
   getPointsBoards,
   getPointsBoard,
+  getMarket,
+  getMarketMeta,
+  getMarketVendor,
   getFeatures,
   stream,
 }