fix: presence, profile edits, outfit menu and RecNetResult writes for the 2023 client

Every change below was checked against the 2023-03-21 client disassembly;
file:line evidence is in the code comments and in
docs/recroom-2023-client-api-complete.md.

Presence
- matchmake/none means "online, in no room" (its only caller is
  TryGoToOfflineRoom, which ignores the reply). The server used to keep the
  old room or invent a dorm, so the next heartbeat looked out of sync and
  the client cancelled its load to chase that room.
- The join watchdog no longer clears presence 30 s into a long room load;
  it is a 3 minute backstop that drops the room only.
- One fan-out (PresenceBroadcastService) for every transition: deferred
  joins, matchmake/none, logout, failed joins, visibility changes, SignalR
  connect/disconnect. isOnline is sent on its own; pushes never go to the
  subject, because a self push moves the player.
- Online-status visibility (Public / Friends / Favorites / Appear offline)
  is stored and honoured by GET /player and by the live pushes.

Profile
- PUT account/me/{emoji,personalpronouns,identityflags,bannerimage} were
  404; added with the client's real form keys and persisted (new Players
  columns plus migration). Every account read now returns them, and edits
  push AccountUpdate to everyone.

Outfit menu
- Saved outfits kept OutfitSelectionsV2 and CustomAvatarItems, so loading a
  slot restores what was saved instead of a stale outfit.
- isCreationAllowedForAccount answers the {Success, Error} envelope the
  client parses; minPriceForPublicItem is a bare int; gifts/generate accepts
  form bodies; lockeditems returns the full owned-item shape; colourways no
  longer share their base item's AvatarItemId.

RecNetResult writes
- About 40 writes look status-only but parse the body as {Success, Error}.
  An empty 200 showed "Failed to ..." after the server applied the change,
  and a body without Success threw "Error message cannot be null". Clubs,
  announcements, keepsakes, comments/read, subscriptions, purchase offers
  and privacy settings now answer RecNetResult.
- Login token and device-code grants are real; remoteauth approves the
  device code; createlogintoken returns a bare string.
- New: incentivizedreferrals/referrals, account/bulk/{email,phone},
  GET strings, account/me/confirmphone, PlayMenuCarouselOrdering_1.
  Route inventory and coverage test extended to match.

README now describes the 2023 branch.

DorkNet.Server/Controllers/API/Avatar/V4/AvatarItemsController.cs

@@ -173,7 +173,12 @@ public class AvatarItemsController(
                 {
                     AvatarItemType = item.AvatarItemType,
                     AvatarItemDesc = ToWatchDesc(entry.FullDesc),
-                    AvatarItemId = item.AvatarItemId,
+                    // Hash the FULL desc, as the toggle-on path does: a
+                    // player can own the base item and several colorways of
+                    // it at once (entries dedupe by FullDesc), and reusing the
+                    // base id made them collide in the client's id-keyed
+                    // wardrobe.
+                    AvatarItemId = StableAvatarItemIdFull(ToWatchDesc(entry.FullDesc)),
                     PlatformMask = item.PlatformMask,
                     FriendlyName = item.FriendlyName,
                     Tooltip = item.Tooltip,
@@ -328,20 +333,19 @@ public class AvatarItemsController(
                 owned.Add(guid);
         }
 
+        // The client parses this as List<IFNGBPJGINL> — the SAME element as
+        // v4/items (FFFIMAGLKEG.txt:3222-3465, NBLIDNCEELM), read by
+        // CLIANCNHNIE which registers TagList / AvatarItemId /
+        // IsBaseAvatarItem too (CLIANCNHNIE.txt). The old 5-key subset left
+        // every locked row at AvatarItemId 0 with a null TagList, so ship
+        // the full catalog DTO.
         var catalog = _catalog.Value.Items;
         var rows = requested
             .Where(guid => !owned.Contains(guid))
             .Distinct(StringComparer.OrdinalIgnoreCase)
             .Select(guid => catalog.TryGetValue(guid, out var item) ? item : null)
             .Where(item => item is not null)
-            .Select(item => new
-            {
-                item!.AvatarItemType,
-                item.AvatarItemDesc,
-                item.FriendlyName,
-                item.Tooltip,
-                item.Rarity,
-            })
+            .Select(item => item!)
             .ToArray();
         return Ok(rows);
     }
@@ -561,9 +565,8 @@ public class AvatarItemsController(
     /// <summary>Stable, deterministic, non-zero 31-bit id for an owned
     /// avatar item, derived from its base GUID (FNV-1a). The 2023 client
     /// keys the wardrobe by <c>AvatarItemId</c>, so it must be unique per
-    /// item and stable across restarts. Colored variants reuse their base
-    /// item's id (a player owns the base OR a variant, never both in the
-    /// list), so no collision.</summary>
+    /// item and stable across restarts. Colored variants must NOT use this — a player can own the base and
+    /// several colorways together; see <see cref="StableAvatarItemIdFull"/>.</summary>
     public static int StableAvatarItemId(string? avatarItemDescOrGuid)
     {
         var guid = (avatarItemDescOrGuid ?? string.Empty).Split(',')[0];