mischief: a storefront where money buys a stranger some trouble

The web half of Mischief Makers M3. A signed-in buyer picks a mark off the
anonymous roster board and pays for a monster to find them; gogobee does the
real work and hands back a verdict Pete files against the order.

- mischief_orders: intent in, verdict out, idempotent on a guid that is the
  end-to-end key gogobee passes to DebitIdem and stamps on the contract
- user_euro + mischief_tiers: advisory balance and the live price list, pushed
  on the roster tick so the storefront never hardcodes a number that can drift
- OIDC-gated buy API (target + tier + signed), bearer-authed poll/claim wire
- roster board grows a 'send trouble' button, a tier picker, and a status panel

Pete never touches money and never runs a game rule. It records what a buyer
wants and what gogobee said happened.

internal/storage/schema.go

@@ -52,6 +52,65 @@ CREATE TABLE IF NOT EXISTS adventure_roster_meta (
     snapshot_at INTEGER NOT NULL DEFAULT 0
 );
 
+-- A signed-in buyer's own euro balance, as of the last snapshot gogobee pushed.
+-- Keyed by localpart (== Authentik preferred_username == the session's Username),
+-- a *separate keyspace* from the anonymous roster tokens on purpose: it is only
+-- ever read for the one authenticated user asking about themselves, so the board
+-- stays anonymous and no endpoint hands out anyone else's number. Advisory only —
+-- the storefront greys out tiers it thinks you can't afford, but the real debit
+-- happens on gogobee at claim time and a stale balance just bounces an order.
+CREATE TABLE IF NOT EXISTS user_euro (
+    username    TEXT PRIMARY KEY,          -- Matrix localpart == session Username
+    euro        REAL NOT NULL DEFAULT 0,
+    snapshot_at INTEGER NOT NULL DEFAULT 0
+);
+
+-- A mischief contract a buyer placed from the web storefront, on its way to
+-- gogobee. Pete never touches money and never runs the game rules — it only
+-- records the *intent* and later the verdict gogobee hands back. The status
+-- ladder:
+--
+--   pending -> placed              (gogobee debited the buyer and opened a contract)
+--           -> bounced_funds       (buyer couldn't actually afford it)
+--           -> bounced_ineligible  (target no longer a valid mark: no expedition,
+--                                    a live contract already, cooldown, cap, ...)
+--
+-- guid is the idempotency key end to end: gogobee passes it to DebitIdem and
+-- stamps it on the contract, so a claim whose ack is lost on the wire can be
+-- retried without charging the buyer twice or opening two contracts. buyer_sub
+-- is the OIDC subject (stable across username changes) and keys "my orders";
+-- buyer_username is what gogobee turns into @username:server. target_token is
+-- the roster token of the mark — the same anonymous token the board renders, so
+-- ordering a hit never needs the victim's real handle.
+CREATE TABLE IF NOT EXISTS mischief_orders (
+    guid           TEXT PRIMARY KEY,
+    buyer_sub      TEXT NOT NULL,
+    buyer_username TEXT NOT NULL,
+    target_token   TEXT NOT NULL,
+    target_name    TEXT NOT NULL,           -- display copy, frozen at order time
+    tier           TEXT NOT NULL,
+    signed         INTEGER NOT NULL DEFAULT 0, -- 1 = sign openly (+25%), 0 = anonymous
+    status         TEXT NOT NULL,           -- see the ladder above
+    detail         TEXT,                    -- gogobee's human note on the verdict
+    created_at     INTEGER NOT NULL,
+    updated_at     INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_mischief_orders_pending ON mischief_orders(status, created_at);
+CREATE INDEX IF NOT EXISTS idx_mischief_orders_buyer ON mischief_orders(buyer_sub, created_at DESC);
+
+-- The storefront price list. gogobee is the sole authority on prices and pushes
+-- the whole catalog on the roster tick, so a fee retune reaches the storefront
+-- within a snapshot and Pete never hardcodes a number that can drift. ordinal
+-- preserves the grunt->boss order the push arrived in.
+CREATE TABLE IF NOT EXISTS mischief_tiers (
+    key        TEXT PRIMARY KEY,
+    display    TEXT NOT NULL,
+    fee        INTEGER NOT NULL,
+    signed_fee INTEGER NOT NULL,
+    blurb      TEXT,
+    ordinal    INTEGER NOT NULL DEFAULT 0
+);
+
 CREATE TABLE IF NOT EXISTS post_log (
     id            INTEGER PRIMARY KEY AUTOINCREMENT,
     guid          TEXT NOT NULL,