Decouple cart/market DBs: denormalize product data, AP internal inbox, OAuth scraper auth

Remove cross-DB relationships (CartItem.product, CartItem.market_place,
OrderItem.product) that break with per-service databases. Denormalize
product and marketplace fields onto cart_items/order_items at write time.

- Add AP internal inbox infrastructure (shared/infrastructure/internal_inbox*)
  for synchronous inter-service writes via HMAC-authenticated POST
- Cart inbox blueprint handles Add/Remove/Update rose:CartItem activities
- Market app sends AP activities to cart inbox instead of writing CartItem directly
- Cart services use denormalized columns instead of cross-DB hydration/joins
- Add marketplaces-by-ids data endpoint to market service
- Alembic migration adds denormalized columns to cart_items and order_items
- Add OAuth device flow auth to market scraper persist_api (artdag client pattern)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cart/app.py

@@ -19,6 +19,7 @@ from bp import (
     register_fragments,
     register_actions,
     register_data,
+    register_inbox,
 )
 from bp.cart.services import (
     get_cart,
@@ -143,6 +144,7 @@ def create_app() -> "Quart":
     app.register_blueprint(register_fragments())
     app.register_blueprint(register_actions())
     app.register_blueprint(register_data())
+    app.register_blueprint(register_inbox())
 
     # --- Page slug hydration (follows events/market app pattern) ---