feat(core): one instance-based ownership model for every kind of owned content

Core could only own players. Everything else a FUT club holds — managers, staff,
consumables, kits, badges, balls, stadiums — had no representation, so the only
way to show one to a client was to synthesise it on read. That is the failure
mode this commit exists to make impossible: read authority, write authority and
persistent ownership authority are now the same rows.

MODEL. There is deliberately NO parallel items table. A manager, a consumable, a
kit and a player are all rows in `owned_cards`, differing only by a new
game-INDEPENDENT `content_kind` (player|manager|staff|consumable|kit|badge|ball|
stadium|misc). A game adapter translates its own taxonomy — FIFA 17's
`cardsubtypeid` and resource ranges — into one of those tokens before ownership
reaches Core; no game's numerics land here. Ownership stays INSTANCE-based:
`card_id` is the definition, `id` is the instance, and two copies of one
definition remain two rows.

`quantity` is a nullable per-instance attribute, not a replacement for the
instance. The real profile settles this: its 17 consumables are instance-based
and only SOME carry a wire `amount` (observed 1,2,4,5,10,15), while two copies of
definition 5003068 exist as two distinct instances. So NULL means "not a stack"
and a positive integer is the stack size; collapsing instances into counts is
forbidden by the model.

ACTIVE DESIGNATIONS. Migration 0024's two-slot kit table becomes
`club_active_items` over the five slots that correspond exactly to the client's
recovered equipped-state vocabulary (activeBadge 100, activeHomeKit 101,
activeAwayKit 102, activeBall 103, activeStadium 104). There is no
activeLeagueLogo or activeMisc token, so those kinds correctly get no slot. The
invariants are schema-enforced rather than conventional: PK(club_id, slot) allows
at most one item per role, `owned_card_id UNIQUE` makes "the same card is both
home and away kit" unstorable, and ON DELETE CASCADE means a quick-sold or
consumed item cannot be projected back as active. 0024's trigger is preserved in
semantics — and dropped EXPLICITLY before its table, because it lives ON
`owned_cards`, so DROP TABLE would have orphaned it and broken every later
ownership transfer. It still exists because the market moves ownership by UPDATE,
which no foreign key can observe.

CONSUMABLE ACTIONS. `services/consume.rs` is one transaction primitive —
validate source ownership and kind, validate target, mutate, consume the source
exactly once, commit — guarded by `UNIQUE(profile_id, action_identity)` in
migration 0027, the same discipline as `match_completions`. It supports both
deleting the row and decrementing a stack, chosen by the caller, inside the one
transaction and the one replay guard. It deliberately contains NO category
formulas: an unreversed effect must not be invented, so callers supply the
mutation and category validation stays explicit.

`/club/kits` is replaced by slot-generic `/club/active-items`. `get_collection`
now carries `content_kind` and `quantity`, accepts a `content_kind` filter, and
— importantly — stops dropping an owned card with a missing definition silently:
the envelope reports `owned_rows`, `unresolved_items` and the offending
definition ids. That silent `filter_map` is the documented cause of a club that
looks empty while the rows are all present.

Verified against a REAL populated club, not a fixture: the production snapshot
(migration 19) is copied to a tempdir, migrated to 0024, given two kit
designations on real owned instances, then migrated to head. 1986 owned rows
survive as content_kind='player', both designations land in `club_active_items`,
no row gains a quantity, and the old table is gone. 258 tests pass, clippy clean.

src/routes/club.rs

@@ -1,8 +1,8 @@
 use crate::extractors::GameId;
 use crate::{
     app::AppState,
-    error::AppResult,
-    models::club::Club,
+    error::{AppError, AppResult},
+    models::{card::ActiveSlot, club::Club},
     services::{
         checkin as checkin_svc, club as club_svc, profile as profile_svc, statistics as stats_svc,
     },
@@ -10,6 +10,7 @@ use crate::{
 use axum::{extract::State, Json};
 use serde::Deserialize;
 use serde_json::{json, Value};
+use std::str::FromStr;
 
 pub async fn get_club(State(state): State<AppState>, game: GameId) -> AppResult<Json<Club>> {
     let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
@@ -164,39 +165,61 @@ pub async fn put_squad_manager(
     Ok(Json(json!({ "manager": manager })))
 }
 
-/// Return the club's ownership-backed active home/away kit assignments.
-pub async fn get_active_kits(
+/// Every active club-item designation, slot-keyed and EXPLICIT: all five slots
+/// are always present, an empty slot being `null`. A caller therefore never has
+/// to guess whether a missing key means "no item" or "unsupported slot".
+fn active_items_body(items: &club_svc::ActiveClubItems) -> AppResult<Value> {
+    let mut body = serde_json::Map::new();
+    for slot in ActiveSlot::ALL {
+        body.insert(
+            slot.as_str().to_string(),
+            serde_json::to_value(items.get(slot))?,
+        );
+    }
+    Ok(Value::Object(body))
+}
+
+/// Return the club's ownership-backed active item designations.
+pub async fn get_active_items(
     State(state): State<AppState>,
     game: GameId,
 ) -> AppResult<Json<Value>> {
     let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
     let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
-    let kits = club_svc::get_active_club_kits(&state.pool, &club.id).await?;
-    Ok(Json(json!({ "home": kits.home, "away": kits.away })))
+    let items = club_svc::get_active_club_items(&state.pool, &club.id).await?;
+    Ok(Json(json!({ "active_items": active_items_body(&items)? })))
 }
 
 #[derive(Deserialize)]
-pub struct SetActiveKitsRequest {
-    pub home_owned_card_id: Option<String>,
-    pub away_owned_card_id: Option<String>,
+pub struct SetActiveItemRequest {
+    /// Which club role to write: home_kit | away_kit | badge | ball | stadium.
+    ///
+    /// Taken as a string and parsed here so an unknown slot comes back as this
+    /// crate's `400 {"error": …}` envelope, like every other bad request, rather
+    /// than axum's plain-text deserialization rejection.
+    pub slot: String,
+    /// The owned instance to designate, or `null`/absent to clear the slot.
+    #[serde(default)]
+    pub owned_card_id: Option<String>,
 }
 
-/// Atomically replace both active kit assignments. Core enforces ownership and
-/// distinct instances; game adapters enforce their own definition taxonomy.
-pub async fn put_active_kits(
+/// Write ONE active club-item designation. Core enforces ownership and that the
+/// slot admits the item's `content_kind`; game adapters own their own mapping
+/// from a wire item onto that generic kind.
+pub async fn put_active_item(
     State(state): State<AppState>,
     game: GameId,
-    Json(req): Json<SetActiveKitsRequest>,
+    Json(req): Json<SetActiveItemRequest>,
 ) -> AppResult<Json<Value>> {
+    let slot = ActiveSlot::from_str(&req.slot).map_err(AppError::BadRequest)?;
     let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
     let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
-    club_svc::set_active_club_kits(
-        &state.pool,
-        &club.id,
-        req.home_owned_card_id.as_deref(),
-        req.away_owned_card_id.as_deref(),
-    )
-    .await?;
-    let kits = club_svc::get_active_club_kits(&state.pool, &club.id).await?;
-    Ok(Json(json!({ "home": kits.home, "away": kits.away })))
+    match req.owned_card_id {
+        Some(owned_card_id) => {
+            club_svc::set_active_club_item(&state.pool, &club.id, slot, &owned_card_id).await?
+        }
+        None => club_svc::clear_active_club_item(&state.pool, &club.id, slot).await?,
+    }
+    let items = club_svc::get_active_club_items(&state.pool, &club.id).await?;
+    Ok(Json(json!({ "active_items": active_items_body(&items)? })))
 }