adventure: let a player leave town from the web, not only read about it

W5a gave the web two verbs that cost nothing. These are the three that take
arguments and spend coins: set out for a zone with a supply loadout, walk back
into the run you extracted from, hire the pet sitter for a week or a month.
Between them they cover the most common thing anybody does in the game, which
until now could only be typed into Matrix.

Arguments are the new surface, so they are the thing to be careful with. Nothing
in a request is trusted: every zone, loadout and duration is looked up in the
offer list gogobee pushed onto that owner's own private row, and the order stores
what was found there rather than what was sent. A forged zone resolves to nothing
and never becomes an order. gogobee then re-resolves all of it anyway, because an
offer is a quote and a quote is not a permission.

The money confirm is the equip panel's, lifted: cost, balance, and the balance it
leaves. When it does not cover, it says so instead of printing a negative.

Verified in a browser rather than only in tests, which is where both real defects
came from: the confirm box was appending to the whole panel and so appeared at
the bottom of the section instead of under the button that raised it, and button
prices printed as EUR45000 above a dialog reading EUR45,000.

Claude-Session: https://claude.ai/code/session_012bxpQQJDjC1mTtLN3VVtBQ

internal/storage/schema.go

@@ -421,9 +421,10 @@ CREATE TABLE IF NOT EXISTS adventure_orders (
     owner_localpart TEXT NOT NULL,
     token           TEXT NOT NULL DEFAULT '',
     character_name  TEXT NOT NULL DEFAULT '',
-    action          TEXT NOT NULL,             -- extract / siege_join
+    action          TEXT NOT NULL,             -- see the AdvAction* set
     status          TEXT NOT NULL,             -- see the ladder above
     detail          TEXT,                      -- gogobee's human note on the verdict
+    params          TEXT NOT NULL DEFAULT '',  -- the verb's arguments as JSON; '' for the verbs that take none
     created_at      INTEGER NOT NULL,
     updated_at      INTEGER NOT NULL
 );