feat(market): disable web submissions by default - #1879

Summary

• hide Web create, upload, update, submit, and withdraw controls while keeping My submissions available as read-only history
• show localized guidance to submit MiniApps and new releases from BitFun Desktop
• add MARKET_WEB_SUBMISSIONS_ENABLED, defaulting to false, and expose the effective value through /miniapp/api/v1/config
• reject Web Cookie submission writes before request-body parsing while preserving Desktop Bearer submissions and Web admin review
• document the feature flag, security boundary, and deployment checks

Security behavior

When Web submissions are disabled, all submission mutation routes authenticate before Axum reads JSON, package, or screenshot bodies. Valid Web sessions receive 403 web_submissions_disabled; anonymous or invalid credentials are rejected before upload parsing. Read-only submission history, ratings, favorites, and administrator review keep their existing behavior.

Documentation audit

Current operational and code-adjacent documentation now consistently describes Web submissions as disabled by default:

• the Web README documents fail-closed config loading and explains why the dormant form/client code remains
• the service README includes an explicit Web Cookie / Desktop Bearer / admin route matrix
• the server README documents the default value, independence from public browsing, container recreation, and /config verification
• the deployment runbook and env example keep the production flag explicit and warn against relying on UI hiding alone

Historical design records were intentionally left unchanged; no current root or architecture document was found claiming browser submissions are open.

Verification

• pnpm run type-check:miniapp-market
• pnpm run test:miniapp-market
• pnpm run build:miniapp-market
• pnpm run i18n:contract:test
• pnpm run i18n:audit
• pnpm run check:repo-hygiene
• cargo test -p bitfun-miniapp-market-service
• cargo check -p bitfun-miniapp-market-server
• cargo check --workspace