fix: correct 2023-03-21 client wire contracts across the API and notify surfaces

Audits every route the March-2023 client can call against what this server
actually serves, and fixes the defects that were breaking gameplay. Adds
docs/recroom-2023-client-api-complete.md as the reference: ~500 route
literals across 13 subsystems, with verb, request/response shape, and a
per-subsystem diff. 315 defects catalogued; the ones fixed here are listed
in its "Already fixed" table.

Path coverage was never the problem — 465 of 506 routes already had
handlers. The failures were in shape, and they cluster into four causes:

- Wrong verb. The verb is a BestHTTP.HTTPMethods ordinal (GET=0 .. PATCH=5),
  confirmed from that enum's static constructor. Routes registered POST-only
  while the client PUTs returned 405, which made room consumables neither
  buyable nor consumable and blocked every room-key edit.
- Bare scalar wrapped in an object. The client reads `1000`, not
  `{"Limit":1000}`; the issuing method signature says which. Wrapping makes
  the deserializer throw and the feature dies silently.
- [FromBody] vs form-urlencoded. The client sends nearly every write as form
  data, which an [ApiController] action bound [FromBody] rejects with 415
  before the handler runs. This alone broke all 13 club member-management
  endpoints. Adds Binding/FormOrJsonModelBinder so this is fixed once.
- Notify dispatch keys. Both enum overloads of the client's RegisterHandler
  lower the id via Int32.ToString() and register only that numeric key, and
  lookup is a case-sensitive TryGetValue that returns silently on a miss. We
  were sending the enum NAME for most ids, so friend-request updates, forced
  logout, maintenance broadcasts, live balance and consumable updates, and
  invention moderation pushes all evaporated with no error anywhere.

Notable behavioural bugs fixed:

- Editing a club announcement deleted it: PUT was a third binding on the
  delete handler. Split apart, and the missing create route added.
- leaderboard/CheckAndSetStat did not exist. The 2023 client has no SetStat
  literal at all, so every leaderboard score it wrote was discarded.
- Setting a club clubhouse cleared it: the handler read roomId from the query
  while the client sends it in the body, then wrote the resulting null.
- Club join requests were inverted (the enum is Open=0, InviteOnly=1,
  AskToJoin=2), so ask-to-join clubs rejected everyone and invite-only clubs
  quietly admitted them.
- Room bans were pushed as id 24, for which the client registers no handler;
  they now go out as ModerationKick with IsBan, so the ban takes effect
  immediately instead of at next login.
- Room-key ownership queries answered for the wrong player, and "has anyone
  bought this key" asked "did I buy it" — always false for the creator.

Also persists settings that were previously acknowledged and dropped
(playlist accessibility/restrictions/level-voting/warning, per-player status
visibility, VR movement mode and avoid-juniors, custom room codes), which is
what the new columns in the migration are for.

One test asserted the old nested PriceAndCurrency response shape; the
client's consumable formatter has no such key and reads Price and
PurchaseCurrencyId flat, so the test was corrected alongside the handler.

DorkNet.Server/Controllers/API/Inventions/InventionsController.cs

@@ -504,9 +504,25 @@ public class InventionsController(
         });
     }
 
+    /// <summary>The 2023-03-21 client names the blob field
+    /// <c>inventionDataFilename</c> and sends four extra cost fields plus the
+    /// creation room and referenced inventions. The record only had
+    /// <c>BlobName</c>, which the client never sends, so the required-parameter
+    /// check rejected every publish with 400 and no new invention version could
+    /// ever be saved.</summary>
     public sealed record AddVersionRequest(
-        long InventionId, string BlobName,
-        int? InstantiationCost, int? LightsCost);
+        long InventionId,
+        string? BlobName,
+        string? InventionDataFilename,
+        int? InstantiationCost, int? LightsCost,
+        int? ChipsCost, int? CloudVariablesCost, int? AiCost,
+        long? CreationRoomId,
+        List<long>? ReferencedInventions)
+    {
+        public string? Blob => !string.IsNullOrWhiteSpace(InventionDataFilename)
+            ? InventionDataFilename
+            : BlobName;
+    }
 
     [HttpPost("api/inventions/v3/addversion")]
     [HttpPost("api/inventions/v4/addversion")]
@@ -517,10 +533,11 @@ public class InventionsController(
         var inv = await db.Inventions.FirstOrDefaultAsync(x => x.Id == req.InventionId && !x.IsDeleted);
         if (inv is null) return NotFound();
         if (inv.CreatorPlayerId != pid) return Forbid();
-        if (string.IsNullOrWhiteSpace(req.BlobName)) return BadRequest("missing BlobName");
+        var blobName = req.Blob;
+        if (string.IsNullOrWhiteSpace(blobName)) return BadRequest("missing inventionDataFilename");
 
         var nextVer = inv.CurrentVersionNumber + 1;
-        inv.CurrentBlobName = req.BlobName;
+        inv.CurrentBlobName = blobName;
         inv.CurrentVersionNumber = nextVer;
         inv.UpdatedAt = DateTime.UtcNow;
 
@@ -529,7 +546,7 @@ public class InventionsController(
             InventionId = inv.Id,
             ReplicationId = Guid.NewGuid().ToString("D"),
             VersionNumber = nextVer,
-            BlobName = req.BlobName,
+            BlobName = blobName,
             InstantiationCost = req.InstantiationCost ?? 0,
             LightsCost = req.LightsCost ?? 0,
         });
@@ -664,7 +681,15 @@ public class InventionsController(
 
     // ── POST mutations ───────────────────────────────────────────────────
 
-    public sealed record SetTagsRequest(long InventionId, string? AutoTags, string? PlayerAddedTags);
+    /// <summary>The client sends <c>AutoTags</c> and <c>CustomTags</c> as JSON
+    /// ARRAYS of strings. Binding them to <c>string</c> made deserialization
+    /// throw, so every tag edit 400'd. <c>PlayerAddedTags</c> is kept as an
+    /// alias for older callers.</summary>
+    public sealed record SetTagsRequest(
+        long InventionId,
+        List<string>? AutoTags,
+        List<string>? CustomTags,
+        List<string>? PlayerAddedTags);
 
     [HttpPost("api/inventions/v1/settags")]
     [Authorize]
@@ -674,8 +699,12 @@ public class InventionsController(
         var inv = await db.Inventions.FirstOrDefaultAsync(x => x.Id == req.InventionId && !x.IsDeleted);
         if (inv is null) return NotFound();
         if (inv.CreatorPlayerId != pid) return Forbid();
-        var combined = string.Join(',', new[] { req.AutoTags, req.PlayerAddedTags }
-            .Where(s => !string.IsNullOrWhiteSpace(s))).Trim(',');
+        var combined = string.Join(',', new[] { req.AutoTags, req.CustomTags, req.PlayerAddedTags }
+            .Where(list => list is not null)
+            .SelectMany(list => list!)
+            .Select(t => t?.Trim())
+            .Where(t => !string.IsNullOrWhiteSpace(t))
+            .Distinct(StringComparer.OrdinalIgnoreCase));
         inv.TagsCsv = combined;
         inv.UpdatedAt = DateTime.UtcNow;
         await db.SaveChangesAsync();