fix: correct 2023-03-21 client wire contracts across the API and notify surfaces

Audits every route the March-2023 client can call against what this server
actually serves, and fixes the defects that were breaking gameplay. Adds
docs/recroom-2023-client-api-complete.md as the reference: ~500 route
literals across 13 subsystems, with verb, request/response shape, and a
per-subsystem diff. 315 defects catalogued; the ones fixed here are listed
in its "Already fixed" table.

Path coverage was never the problem — 465 of 506 routes already had
handlers. The failures were in shape, and they cluster into four causes:

- Wrong verb. The verb is a BestHTTP.HTTPMethods ordinal (GET=0 .. PATCH=5),
  confirmed from that enum's static constructor. Routes registered POST-only
  while the client PUTs returned 405, which made room consumables neither
  buyable nor consumable and blocked every room-key edit.
- Bare scalar wrapped in an object. The client reads `1000`, not
  `{"Limit":1000}`; the issuing method signature says which. Wrapping makes
  the deserializer throw and the feature dies silently.
- [FromBody] vs form-urlencoded. The client sends nearly every write as form
  data, which an [ApiController] action bound [FromBody] rejects with 415
  before the handler runs. This alone broke all 13 club member-management
  endpoints. Adds Binding/FormOrJsonModelBinder so this is fixed once.
- Notify dispatch keys. Both enum overloads of the client's RegisterHandler
  lower the id via Int32.ToString() and register only that numeric key, and
  lookup is a case-sensitive TryGetValue that returns silently on a miss. We
  were sending the enum NAME for most ids, so friend-request updates, forced
  logout, maintenance broadcasts, live balance and consumable updates, and
  invention moderation pushes all evaporated with no error anywhere.

Notable behavioural bugs fixed:

- Editing a club announcement deleted it: PUT was a third binding on the
  delete handler. Split apart, and the missing create route added.
- leaderboard/CheckAndSetStat did not exist. The 2023 client has no SetStat
  literal at all, so every leaderboard score it wrote was discarded.
- Setting a club clubhouse cleared it: the handler read roomId from the query
  while the client sends it in the body, then wrote the resulting null.
- Club join requests were inverted (the enum is Open=0, InviteOnly=1,
  AskToJoin=2), so ask-to-join clubs rejected everyone and invite-only clubs
  quietly admitted them.
- Room bans were pushed as id 24, for which the client registers no handler;
  they now go out as ModerationKick with IsBan, so the ban takes effect
  immediately instead of at next login.
- Room-key ownership queries answered for the wrong player, and "has anyone
  bought this key" asked "did I buy it" — always false for the creator.

Also persists settings that were previously acknowledged and dropped
(playlist accessibility/restrictions/level-voting/warning, per-player status
visibility, VR movement mode and avoid-juniors, custom room codes), which is
what the new columns in the migration are for.

One test asserted the old nested PriceAndCurrency response shape; the
client's consumable formatter has no such key and reads Price and
PurchaseCurrencyId flat, so the test was corrected alongside the handler.

DorkNet.Server/Migrations/20260727200252_Client2023WireFixes.cs

@@ -0,0 +1,132 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace DorkNet.Server.Migrations
+{
+    /// <summary>
+    /// Columns needed by the March-2023 client wire fixes: the playlist
+    /// settings the client can set (accessibility, level voting, VR/junior
+    /// restrictions, content warning) which used to be acknowledged and thrown
+    /// away, plus a host-chosen room code on private instances.
+    ///
+    /// Hand-trimmed after generation: `migrations add` diffs against the
+    /// committed model snapshot, which already lagged the entity model, so the
+    /// generated file also carried unrelated pre-existing drift
+    /// (ServerSettings, Rooms, Avatars, ...). Replaying that against a database
+    /// where those columns already exist fails on the first duplicate
+    /// ADD COLUMN, so only the columns this change introduces are kept.
+    /// </summary>
+    public partial class Client2023WireFixes : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "RoomCode",
+                table: "PrivateInstances",
+                type: "TEXT",
+                maxLength: 16,
+                nullable: false,
+                defaultValue: "");
+
+            migrationBuilder.AddColumn<int>(
+                name: "Accessibility",
+                table: "Playlists",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: 0);
+
+            migrationBuilder.AddColumn<string>(
+                name: "CustomWarning",
+                table: "Playlists",
+                type: "TEXT",
+                maxLength: 512,
+                nullable: false,
+                defaultValue: "");
+
+            migrationBuilder.AddColumn<bool>(
+                name: "SupportsJuniors",
+                table: "Playlists",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: false);
+
+            migrationBuilder.AddColumn<bool>(
+                name: "SupportsLevelVoting",
+                table: "Playlists",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: false);
+
+            migrationBuilder.AddColumn<bool>(
+                name: "SupportsScreens",
+                table: "Playlists",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: false);
+
+            migrationBuilder.AddColumn<bool>(
+                name: "SupportsTeleportVR",
+                table: "Playlists",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: false);
+
+            migrationBuilder.AddColumn<bool>(
+                name: "SupportsWalkVR",
+                table: "Playlists",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: false);
+
+            migrationBuilder.AddColumn<int>(
+                name: "WarningMask",
+                table: "Playlists",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: 0);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "RoomCode",
+                table: "PrivateInstances");
+
+            migrationBuilder.DropColumn(
+                name: "Accessibility",
+                table: "Playlists");
+
+            migrationBuilder.DropColumn(
+                name: "CustomWarning",
+                table: "Playlists");
+
+            migrationBuilder.DropColumn(
+                name: "SupportsJuniors",
+                table: "Playlists");
+
+            migrationBuilder.DropColumn(
+                name: "SupportsLevelVoting",
+                table: "Playlists");
+
+            migrationBuilder.DropColumn(
+                name: "SupportsScreens",
+                table: "Playlists");
+
+            migrationBuilder.DropColumn(
+                name: "SupportsTeleportVR",
+                table: "Playlists");
+
+            migrationBuilder.DropColumn(
+                name: "SupportsWalkVR",
+                table: "Playlists");
+
+            migrationBuilder.DropColumn(
+                name: "WarningMask",
+                table: "Playlists");
+        }
+    }
+}