fix: correct 2023-03-21 client wire contracts across the API and notify surfaces

Audits every route the March-2023 client can call against what this server
actually serves, and fixes the defects that were breaking gameplay. Adds
docs/recroom-2023-client-api-complete.md as the reference: ~500 route
literals across 13 subsystems, with verb, request/response shape, and a
per-subsystem diff. 315 defects catalogued; the ones fixed here are listed
in its "Already fixed" table.

Path coverage was never the problem — 465 of 506 routes already had
handlers. The failures were in shape, and they cluster into four causes:

- Wrong verb. The verb is a BestHTTP.HTTPMethods ordinal (GET=0 .. PATCH=5),
  confirmed from that enum's static constructor. Routes registered POST-only
  while the client PUTs returned 405, which made room consumables neither
  buyable nor consumable and blocked every room-key edit.
- Bare scalar wrapped in an object. The client reads `1000`, not
  `{"Limit":1000}`; the issuing method signature says which. Wrapping makes
  the deserializer throw and the feature dies silently.
- [FromBody] vs form-urlencoded. The client sends nearly every write as form
  data, which an [ApiController] action bound [FromBody] rejects with 415
  before the handler runs. This alone broke all 13 club member-management
  endpoints. Adds Binding/FormOrJsonModelBinder so this is fixed once.
- Notify dispatch keys. Both enum overloads of the client's RegisterHandler
  lower the id via Int32.ToString() and register only that numeric key, and
  lookup is a case-sensitive TryGetValue that returns silently on a miss. We
  were sending the enum NAME for most ids, so friend-request updates, forced
  logout, maintenance broadcasts, live balance and consumable updates, and
  invention moderation pushes all evaporated with no error anywhere.

Notable behavioural bugs fixed:

- Editing a club announcement deleted it: PUT was a third binding on the
  delete handler. Split apart, and the missing create route added.
- leaderboard/CheckAndSetStat did not exist. The 2023 client has no SetStat
  literal at all, so every leaderboard score it wrote was discarded.
- Setting a club clubhouse cleared it: the handler read roomId from the query
  while the client sends it in the body, then wrote the resulting null.
- Club join requests were inverted (the enum is Open=0, InviteOnly=1,
  AskToJoin=2), so ask-to-join clubs rejected everyone and invite-only clubs
  quietly admitted them.
- Room bans were pushed as id 24, for which the client registers no handler;
  they now go out as ModerationKick with IsBan, so the ban takes effect
  immediately instead of at next login.
- Room-key ownership queries answered for the wrong player, and "has anyone
  bought this key" asked "did I buy it" — always false for the creator.

Also persists settings that were previously acknowledged and dropped
(playlist accessibility/restrictions/level-voting/warning, per-player status
visibility, VR movement mode and avoid-juniors, custom room codes), which is
what the new columns in the migration are for.

One test asserted the old nested PriceAndCurrency response shape; the
client's consumable formatter has no such key and reads Price and
PurchaseCurrencyId flat, so the test was corrected alongside the handler.

DorkNet.Server/Controllers/API/Comments/CommentsController.cs

@@ -7,12 +7,31 @@ namespace DorkNet.Server.Controllers.API.Comments;
 
 /// <summary>
 /// Room-comment unread counts. Client contract (RecNet.Runtime
-/// <c>DJLNMANKMAA(IReadOnlyCollection&lt;long&gt;)</c>): the caller sends a
-/// collection of roomIds and expects a top-level JSON OBJECT
-/// <c>Dictionary&lt;long, uint&gt;</c> mapping roomId → unread count.
-/// We don't track per-player comment read-state yet, so every requested
-/// room maps to 0 — a correct, non-crashing "nothing unread" answer that
-/// matches the wire shape (an object, never an array).
+/// <c>OPELMBNJHNO.DJLNMANKMAA(IReadOnlyCollection&lt;long&gt;)</c>).
+///
+/// The response is a JSON <b>ARRAY</b>, not an object. The method's return
+/// type is <c>Dictionary&lt;long,uint&gt;</c>, but that dictionary is built
+/// client-side: OPELMBNJHNO.txt:889 constructs a
+/// <c>Func&lt;List&lt;UnreadRoomComments&gt;, Dictionary&lt;long,uint&gt;&gt;</c>
+/// projection that runs over the deserialised payload. So the wire type is
+/// <c>List&lt;RecNet.UnreadRoomComments&gt;</c> — each element an object with a
+/// room id (Int64) and a count (UInt32), per the two properties on
+/// RecNet/UnreadRoomComments.txt.
+///
+/// This previously returned an object map keyed by room id. Json.NET cannot
+/// read a JSON object into a <c>List&lt;T&gt;</c>, so every call threw and the
+/// client logged "Failed to get unread room comment counts"
+/// (OPELMBNJHNO.txt:937) and fell back to an empty dictionary — the watch's
+/// room-comment unread badge never appeared.
+///
+/// The element's exact property names are attribute-driven and are not
+/// recoverable from the ISIL (see the note on key aliasing below), so each
+/// element carries the plausible spellings side by side. Json.NET matches
+/// case-insensitively and ignores unknown members, so the extra aliases are
+/// inert whichever name the DTO actually declares.
+///
+/// Counts are all zero until per-player comment read-state is tracked; the
+/// shape is what matters for the client not to throw.
 /// </summary>
 [ApiController]
 [Authorize]
@@ -24,10 +43,14 @@ public class CommentsController : ControllerBase
     public async Task<IActionResult> UnreadCounts()
     {
         var roomIds = await ReadRoomIdsAsync();
-        // Keys must be strings in JSON; values are the (currently always 0)
-        // unread counts.
-        var result = new Dictionary<string, uint>();
-        foreach (var id in roomIds) result[id.ToString()] = 0;
+        var result = roomIds
+            .Select(id => new Dictionary<string, object>
+            {
+                ["RoomId"]       = id,
+                ["UnreadCount"]  = 0u,
+                ["Count"]        = 0u,
+            })
+            .ToList();
         return Ok(result);
     }