fix: presence, profile edits, outfit menu and RecNetResult writes for the 2023 client

Every change below was checked against the 2023-03-21 client disassembly;
file:line evidence is in the code comments and in
docs/recroom-2023-client-api-complete.md.

Presence
- matchmake/none means "online, in no room" (its only caller is
  TryGoToOfflineRoom, which ignores the reply). The server used to keep the
  old room or invent a dorm, so the next heartbeat looked out of sync and
  the client cancelled its load to chase that room.
- The join watchdog no longer clears presence 30 s into a long room load;
  it is a 3 minute backstop that drops the room only.
- One fan-out (PresenceBroadcastService) for every transition: deferred
  joins, matchmake/none, logout, failed joins, visibility changes, SignalR
  connect/disconnect. isOnline is sent on its own; pushes never go to the
  subject, because a self push moves the player.
- Online-status visibility (Public / Friends / Favorites / Appear offline)
  is stored and honoured by GET /player and by the live pushes.

Profile
- PUT account/me/{emoji,personalpronouns,identityflags,bannerimage} were
  404; added with the client's real form keys and persisted (new Players
  columns plus migration). Every account read now returns them, and edits
  push AccountUpdate to everyone.

Outfit menu
- Saved outfits kept OutfitSelectionsV2 and CustomAvatarItems, so loading a
  slot restores what was saved instead of a stale outfit.
- isCreationAllowedForAccount answers the {Success, Error} envelope the
  client parses; minPriceForPublicItem is a bare int; gifts/generate accepts
  form bodies; lockeditems returns the full owned-item shape; colourways no
  longer share their base item's AvatarItemId.

RecNetResult writes
- About 40 writes look status-only but parse the body as {Success, Error}.
  An empty 200 showed "Failed to ..." after the server applied the change,
  and a body without Success threw "Error message cannot be null". Clubs,
  announcements, keepsakes, comments/read, subscriptions, purchase offers
  and privacy settings now answer RecNetResult.
- Login token and device-code grants are real; remoteauth approves the
  device code; createlogintoken returns a bare string.
- New: incentivizedreferrals/referrals, account/bulk/{email,phone},
  GET strings, account/me/confirmphone, PlayMenuCarouselOrdering_1.
  Route inventory and coverage test extended to match.

README now describes the 2023 branch.

DorkNet.Server/Controllers/API/CustomAvatarItems/CustomAvatarItemsController.cs

@@ -371,11 +371,22 @@ public class CustomAvatarItemsController(
         var allowed = player is not null
             && !player.IsJunior
             && (player.BannedUntil is null || player.BannedUntil <= DateTime.UtcNow);
-        // Bare JSON boolean, like the two sibling gates below: the client's
-        // issuing method is FGLDKEJLAKB<System.Boolean> GGMDLMLJDDK()
-        // (RecNet.Runtime/MPBLNLMCEDL.txt:6048, route literal on :6205), so an
-        // object body threw and the can-create gate blocked shirt creation.
-        return Content(allowed ? "true" : "false", "application/json");
+        // NOT a bare boolean, unlike the two sibling gates below. The issuing
+        // method GGMDLMLJDDK (RecNet.Runtime/MPBLNLMCEDL.txt:6048, route on
+        // :6205) parses the body as DJMHAFPGLLN — {Boolean @0x10, String} —
+        // (generic token 0x188477F70 at :6216; Func<DJMHAFPGLLN,…> at :6223)
+        // and its success continuation HONEEPBHNLB reads the bool at +0x10
+        // (:9155-9216).
+        // DJMHAFPGLLN's converter LMCCNLLHLCJ registers exactly the keys
+        // "Success" and "Error" (LMCCNLLHLCJ.txt:191-254). A bare `true`
+        // failed that parse, so the client logged "Failed to query if local
+        // account can create Custom Avatar Items: An error occurred" and
+        // treated the account as unable to create shirts.
+        return Ok(new Dictionary<string, object?>
+        {
+            ["Success"] = allowed,
+            ["Error"] = allowed ? null : "Custom avatar item creation is not available for this account.",
+        });
     }
 
     [HttpGet("isCreationEnabled")]
@@ -386,22 +397,17 @@ public class CustomAvatarItemsController(
     [AllowAnonymous]
     public IActionResult IsRenderingEnabled() => Content("true", "application/json");
 
-    /// <summary>The client DTO (IHLMDLKOLNB) is an object with exactly one
-    /// Int32 property, but its accessor name (GFGCCNBDKAK) appears nowhere
-    /// else in the dump, so — unlike Price/BaseAvatarItemId/Color, which are
-    /// pinned by accessors shared with NOAAFNFJPFB — the JSON key is NOT
-    /// recoverable. All four spellings below are UNPROVEN hedges; Newtonsoft
-    /// ignores the ones that don't match, and a total miss falls back to the
-    /// DTO's static default (IHLMDLKOLNB.txt:75-117) rather than throwing.</summary>
+    /// <summary>Bare JSON integer. The client's IHLMDLKOLNB pricing config is
+    /// built CLIENT-side: HCBOHHEACPK sends through FDKKOPAPDGF&lt;Int32&gt;
+    /// (RecNet.Runtime/MPBLNLMCEDL.txt:6922 — the same generic token
+    /// 0x18847B0B8 as the bare-Int32 itemOwnershipLimit call at :2981) and
+    /// continues with <c>&lt;GetPricingConfig&gt;b__69_0(Int32 minimumPrice)</c>
+    /// (MPBLNLMCEDL_NestedType___c.txt:286). An object body failed the Int32
+    /// parse, so the designer's public-price floor never loaded.</summary>
     [HttpGet("minPriceForPublicItem")]
     [AllowAnonymous]
-    public IActionResult MinPriceForPublicItem() => Ok(new
-    {
-        MinPrice = MinPublicItemPrice,
-        Price = MinPublicItemPrice,
-        MinimumPrice = MinPublicItemPrice,
-        MinPriceForPublicItem = MinPublicItemPrice,
-    });
+    public IActionResult MinPriceForPublicItem()
+        => Content(MinPublicItemPrice.ToString(System.Globalization.CultureInfo.InvariantCulture), "application/json");
 
     /// <summary>GET api/customAvatarItems/v1/design — hand back the caller's
     /// saved in-progress shirt design. Verb ordinal 0 = GET