feat(rewards): shop, equipped looks and public looks

Add endpoints to buy items, equip looks by slot and unequip. The shop has
8 whitelisted looks: avatar borders, badges, accents and banner frames.
Ownership is a BUY ledger row; PLATFORM_ADMIN owns every catalog item
without buying. The public profile endpoint shares only the equipped looks
filtered by ownership.

src/test/resources/contract/auth-core-contract.json

@@ -13,6 +13,7 @@
       "aud": ["tbp-public-profile"],
       "sub": "public-profile",
       "profileUserId": "42",
+      "role": "USER",
       "profileStats": ["OVERVIEW"],
       "sections": ["SUMMARY"]
     },