Fix the store showing every item as free, and six layout defects

The catalogue served every price as $0.00. The Cosmetic struct typed
price_cents as i64 against an INTEGER column, so sqlx refused the decode and
unwrap_or_default turned the failure into a zero. Nothing was logged. The
whole store read as free while the database held the real prices.

Decode errors are now returned rather than defaulted away, and create_session
refuses any amount at or below zero, so a price that fails to decode cannot
become a session that grants an item without charging.

Layout, all measured in a real browser at 1280, 820 and 390 pixels:

- The close button sat underneath the fixed top rail. The rail reaches into
  the content column on any viewport under about 1350px, so the overlap was
  there for nearly every visitor. The button starts below the rail now.
- The wordmark and the top rail overlapped by 75px at 390px. Both are fixed
  to the top of the viewport and neither knew about the other. Both give
  ground on narrow screens, and Sign Up drops out of the rail because Sign In
  reaches the same screen.
- Store rows were 93px tall for one line of content, because .menu-button
  carries a vertical margin meant for a stacked menu. Twenty six items came
  to 2400px of scrolling. Rows are 47px and the page is 2467px rather than
  3784px.
- .stats-screen centres its children, so any child without a declared width
  shrink-wraps. That left the sign-in box at 415px, the bundle grid at 488px
  (which collapsed it to a single column) and the leaderboard table at 498px,
  all inside a 636px column. Every screen was swept for the same defect.
  .account-panel is the one narrow child that is deliberate: it declares
  max-width 360px because a sign-in form should not be 636px wide.
- Leaderboard rows had a hard 461px minimum from fixed column widths, so at
  390px the row ran from x=-36 to x=426 and the date column was cut off the
  side of the screen. The date is hidden on narrow viewports.
- The profile links in the leaderboard were 21px tall, under the 24x24
  minimum target size, and they are the only route to a player's profile.

Sprites never showed as equipped: the store compared the equipped caret and
flair but not the sprite.

The store test bought items by clicking Buy, which used to grant them for
nothing. It now asserts that Buy does not grant, then grants the items the
way a signature-verified webhook would, and goes on to check that an equipped
caret colour reaches the typing screen.

All 21 screen and viewport combinations are clean for overlap, overflow,
clipped content and target size. 3/3 browser tests pass.

0 files changed, 0 insertions, 0 deletions