adventure: let an owner equip and unequip from their own page

The one adventure ask that carries intent back to the game box, built the
mischief way: no new network route, Pete records the equip/unequip and gogobee
polls it and files a verdict. The who page grows Equip / Take off buttons on the
owner's own worn and backpack panels, and a pending-changes strip that shows
'queued' until the verdict lands, never claiming a change it can't see.

The item handle is the inventory row id, sent only on wearable magic items, so a
non-zero id is also what gates the button. gogobee resolves the owner by
localpart, never a name.

internal/storage/schema.go

@@ -151,6 +151,43 @@ CREATE TABLE IF NOT EXISTS mischief_tiers (
     ordinal    INTEGER NOT NULL DEFAULT 0
 );
 
+-- An equip/unequip an owner asked for from their own detail page, on its way to
+-- gogobee. This is the one adventure feature that carries intent *back* to the
+-- game box; it does it the mischief way, with no new network route — Pete records
+-- the intent, gogobee polls and applies it against its own equipment tables, and
+-- pushes back a verdict. The status ladder:
+--
+--   pending -> applied                  (worn or removed; detail says how)
+--           -> rejected_not_owned       (the item left the pack before gogobee got here)
+--           -> rejected_not_worn        (unequip of an already-empty slot)
+--           -> rejected_not_equippable  (the item has no slot to fill)
+--
+-- guid is the idempotency key end to end. Note the game action is NOT naturally
+-- idempotent (equipping consumes an inventory row), so gogobee short-circuits on
+-- this guid before it mutates — unlike mischief, whose action converges on its
+-- own. owner_sub is the OIDC subject (stable across renames) and keys "my orders";
+-- owner_localpart is the Matrix localpart gogobee turns into the MXID of the
+-- character to dress. item_id is the adventure_inventory row id for an equip (the
+-- table is AUTOINCREMENT, so a stale id misses cleanly rather than hitting the
+-- wrong item); an unequip keys on slot alone. character_name and item_name are
+-- frozen display copy gogobee ignores.
+CREATE TABLE IF NOT EXISTS equip_orders (
+    guid            TEXT PRIMARY KEY,
+    owner_sub       TEXT NOT NULL,
+    owner_localpart TEXT NOT NULL,
+    character_name  TEXT NOT NULL DEFAULT '',
+    item_id         INTEGER NOT NULL DEFAULT 0,
+    item_name       TEXT NOT NULL DEFAULT '',
+    slot            TEXT NOT NULL DEFAULT '',
+    action          TEXT NOT NULL,             -- equip / unequip
+    status          TEXT NOT NULL,             -- see the ladder above
+    detail          TEXT,                      -- gogobee's human note on the verdict
+    created_at      INTEGER NOT NULL,
+    updated_at      INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_equip_orders_pending ON equip_orders(status, created_at);
+CREATE INDEX IF NOT EXISTS idx_equip_orders_owner ON equip_orders(owner_sub, created_at DESC);
+
 -- A player's private, owner-only expansion — inventory, vault, house, pets —
 -- pushed whole by gogobee on the roster tick. Keyed by localpart (== session
 -- Username), a *separate keyspace* from the anonymous roster tokens on purpose: