mischief: a storefront where money buys a stranger some trouble

The web half of Mischief Makers M3. A signed-in buyer picks a mark off the
anonymous roster board and pays for a monster to find them; gogobee does the
real work and hands back a verdict Pete files against the order.

- mischief_orders: intent in, verdict out, idempotent on a guid that is the
  end-to-end key gogobee passes to DebitIdem and stamps on the contract
- user_euro + mischief_tiers: advisory balance and the live price list, pushed
  on the roster tick so the storefront never hardcodes a number that can drift
- OIDC-gated buy API (target + tier + signed), bearer-authed poll/claim wire
- roster board grows a 'send trouble' button, a tier picker, and a status panel

Pete never touches money and never runs a game rule. It records what a buyer
wants and what gogobee said happened.

internal/storage/roster.go

@@ -91,6 +91,27 @@ func LoadRoster() ([]RosterEntry, int64, error) {
 	return out, RosterSnapshotAt(), nil
 }
 
+// RosterEntryByToken looks up one adventurer by their roster token. The bool is
+// false when no such token is on the current board — which is exactly the check
+// the storefront needs: a buyer may only order a hit on a mark the live board is
+// actually showing, never a stale or guessed token.
+func RosterEntryByToken(token string) (RosterEntry, bool, error) {
+	var e RosterEntry
+	err := Get().QueryRow(`
+		SELECT token, name, level, COALESCE(class_race, ''), status,
+		       COALESCE(zone, ''), COALESCE(region, ''), day, idle_hours, snapshot_at
+		  FROM adventure_roster WHERE token = ?`, token).Scan(
+		&e.Token, &e.Name, &e.Level, &e.ClassRace, &e.Status,
+		&e.Zone, &e.Region, &e.Day, &e.IdleHours, &e.SnapshotAt)
+	if err == sql.ErrNoRows {
+		return RosterEntry{}, false, nil
+	}
+	if err != nil {
+		return RosterEntry{}, false, err
+	}
+	return e, true, nil
+}
+
 // RosterSnapshotAt reports when the board was last refreshed, 0 if gogobee has
 // never pushed one. Read from the meta row, not the entries, so a snapshot that
 // legitimately carried nobody still counts as a snapshot.