fix: correct 2023-03-21 client wire contracts across the API and notify surfaces

Audits every route the March-2023 client can call against what this server
actually serves, and fixes the defects that were breaking gameplay. Adds
docs/recroom-2023-client-api-complete.md as the reference: ~500 route
literals across 13 subsystems, with verb, request/response shape, and a
per-subsystem diff. 315 defects catalogued; the ones fixed here are listed
in its "Already fixed" table.

Path coverage was never the problem — 465 of 506 routes already had
handlers. The failures were in shape, and they cluster into four causes:

- Wrong verb. The verb is a BestHTTP.HTTPMethods ordinal (GET=0 .. PATCH=5),
  confirmed from that enum's static constructor. Routes registered POST-only
  while the client PUTs returned 405, which made room consumables neither
  buyable nor consumable and blocked every room-key edit.
- Bare scalar wrapped in an object. The client reads `1000`, not
  `{"Limit":1000}`; the issuing method signature says which. Wrapping makes
  the deserializer throw and the feature dies silently.
- [FromBody] vs form-urlencoded. The client sends nearly every write as form
  data, which an [ApiController] action bound [FromBody] rejects with 415
  before the handler runs. This alone broke all 13 club member-management
  endpoints. Adds Binding/FormOrJsonModelBinder so this is fixed once.
- Notify dispatch keys. Both enum overloads of the client's RegisterHandler
  lower the id via Int32.ToString() and register only that numeric key, and
  lookup is a case-sensitive TryGetValue that returns silently on a miss. We
  were sending the enum NAME for most ids, so friend-request updates, forced
  logout, maintenance broadcasts, live balance and consumable updates, and
  invention moderation pushes all evaporated with no error anywhere.

Notable behavioural bugs fixed:

- Editing a club announcement deleted it: PUT was a third binding on the
  delete handler. Split apart, and the missing create route added.
- leaderboard/CheckAndSetStat did not exist. The 2023 client has no SetStat
  literal at all, so every leaderboard score it wrote was discarded.
- Setting a club clubhouse cleared it: the handler read roomId from the query
  while the client sends it in the body, then wrote the resulting null.
- Club join requests were inverted (the enum is Open=0, InviteOnly=1,
  AskToJoin=2), so ask-to-join clubs rejected everyone and invite-only clubs
  quietly admitted them.
- Room bans were pushed as id 24, for which the client registers no handler;
  they now go out as ModerationKick with IsBan, so the ban takes effect
  immediately instead of at next login.
- Room-key ownership queries answered for the wrong player, and "has anyone
  bought this key" asked "did I buy it" — always false for the creator.

Also persists settings that were previously acknowledged and dropped
(playlist accessibility/restrictions/level-voting/warning, per-player status
visibility, VR movement mode and avoid-juniors, custom room codes), which is
what the new columns in the migration are for.

One test asserted the old nested PriceAndCurrency response shape; the
client's consumable formatter has no such key and reads Price and
PurchaseCurrencyId flat, so the test was corrected alongside the handler.

DorkNet.Server/Controllers/API/RoomConsumables/RoomConsumablesController.cs

@@ -227,6 +227,11 @@ public class RoomConsumablesController(DorkNetDbContext db, LevelService level)
     /// — buy one stack unit with tokens. Response is
     /// <c>{ OperationResult, BalanceUpdateResult, TokenBalanceResponse:
     /// { CurrencyType, Balance, Platform } }</c>.</summary>
+    // The 2023-03-21 client PUTs this (verb literal 3 = PUT, at the route
+    // construction in RecNet.Runtime/DCFKEFHJAGC.txt instrs 097-108), so a
+    // POST-only mapping returned 405 and token-priced consumables were
+    // unbuyable. Both verbs are accepted now.
+    [HttpPut("api/roomconsumables/v1/roomconsumable/{publicId:guid}/purchase/tokens")]
     [HttpPost("api/roomconsumables/v1/roomconsumable/{publicId:guid}/purchase/tokens")]
     [Authorize]
     public async Task<IActionResult> PurchaseTokens(Guid publicId)
@@ -263,6 +268,9 @@ public class RoomConsumablesController(DorkNetDbContext db, LevelService level)
     /// — buy with a room currency. Response is <c>{ OperationResult,
     /// BalanceUpdateResult, CurrencyBalanceResponse: { AccountId,
     /// CurrencyId, Balance, ModifiedAt } }</c>.</summary>
+    // PUT per the client (verb literal 3 at DCFKEFHJAGC.txt instrs 112-123);
+    // POST-only returned 405 and currency-priced consumables were unbuyable.
+    [HttpPut("api/roomconsumables/v1/roomconsumable/{publicId:guid}/purchase/currency")]
     [HttpPost("api/roomconsumables/v1/roomconsumable/{publicId:guid}/purchase/currency")]
     [Authorize]
     public async Task<IActionResult> PurchaseCurrency(Guid publicId)
@@ -304,6 +312,10 @@ public class RoomConsumablesController(DorkNetDbContext db, LevelService level)
     /// NewConcurrencyCode }</c>; response <c>{ Status, InventoryItem }</c>.
     /// On a code mismatch the current row is returned so the client can
     /// resync.</summary>
+    // PUT per the client (route format "{0}/v1/roomConsumable/{1}/consume"
+    // with verb literal 3 at RecNet.Runtime/LPNHMEFDAAG.txt:1449-1460);
+    // POST-only returned 405, so no consumable could ever be consumed.
+    [HttpPut("api/roomconsumables/v1/roomConsumable/{publicId:guid}/consume")]
     [HttpPost("api/roomconsumables/v1/roomConsumable/{publicId:guid}/consume")]
     [Authorize]
     public async Task<IActionResult> Consume(Guid publicId)
@@ -404,6 +416,18 @@ public class RoomConsumablesController(DorkNetDbContext db, LevelService level)
         },
     };
 
+    /// <summary>Consumable descriptor as the client READS it.
+    ///
+    /// The price is FLAT here — the client's response formatter FCIBLPCOODP
+    /// reads <c>Price</c>, <c>PurchaseCurrencyId</c> and <c>ModifiedAt</c>
+    /// directly off the descriptor (RecNet.Runtime/FCIBLPCOODP.txt:670-710).
+    /// Emitting a nested <c>PriceAndCurrency</c> object left every item in
+    /// every room shop reading back Price=0 with a null currency, so the whole
+    /// catalogue looked token-priced and free.
+    ///
+    /// Note the asymmetry: REQUEST bodies really do nest PriceAndCurrency, and
+    /// ReadBodyAsync below still flattens that on the way in. Only the response
+    /// shape changed.</summary>
     private static object ToDescWire(RoomConsumableEntity c) => new
     {
         RoomConsumableId = c.PublicId,
@@ -411,7 +435,9 @@ public class RoomConsumablesController(DorkNetDbContext db, LevelService level)
         c.Name,
         c.Description,
         c.ImageName,
-        PriceAndCurrency = new { c.Price, c.CurrencyId },
+        c.Price,
+        PurchaseCurrencyId = c.CurrencyId,
+        ModifiedAt = DateTime.SpecifyKind(c.UpdatedAt, DateTimeKind.Utc),
     };
 
     private static object ToInventoryWire(RoomConsumableOwnershipEntity own, RoomConsumableEntity item) => new