feat(miniapp): add reviewed MiniApp marketplace

[bobleer]

Summary

• add platform-agnostic MiniApp marketplace contracts and immutable release state transitions
• add an Axum + SQLite market service with GitHub OAuth, submissions, human review, ratings, favorites, search, downloads, retention, and audit logs
• add strict .bfminiapp validation, content-addressed artifacts, reviewed package hashes, and market-only runtime security controls
• add a responsive standalone market Web app under /miniapp/ with three locales, system-aware light/dark themes, submission management, and Web admin review
• add native BitFun Market and My Submissions views with desktop authorization, package creation, install/update flows, permission diffs, rollback, and remote-workspace policy declarations
• add Docker, Nginx, backup/restore, and AI-agent-friendly deployment documentation for the isolated market service

Security boundaries

• market packages cannot enable Node, npm dependencies, non-empty ESM dependencies, remote executable loading, or non-no-op workers
• archive validation rejects zip slip, links, duplicate or case-conflicting paths, forbidden files, malformed metadata, and expanded-size bombs
• reviewed releases bind canonical metadata, package SHA-256, and screenshot hashes; approved versions remain immutable and can be yanked
• market runtime uses a strict CSP and isolated app origin, with host-side permission, path, shell, network, and SSRF checks
• OAuth uses state, PKCE, CSRF protection, rotating tokens, and numeric GitHub ID admin checks

Validation

• cargo test -p bitfun-miniapp-market-service (19 passed)
• cargo test -p bitfun-product-domains --features miniapp (115 passed)
• cargo check --workspace
• pnpm run type-check:miniapp-market
• pnpm run test:miniapp-market (5 passed)
• pnpm run build:miniapp-market
• pnpm run type-check:web
• pnpm run i18n:contract:test (37 passed)
• pnpm run i18n:audit
• pnpm run theme:color-audit:all
• production Docker build, health/API checks, and desktop/mobile browser smoke tests at https://market.openbitfun.com/miniapp/

Operational notes

The market remains intentionally gated with MARKET_PUBLIC_BROWSE=false until an administrator approves a sample and a fresh desktop client completes install/update acceptance. GitHub OAuth credentials are deployment configuration and are not included in this change.