Decouple cart/market DBs: denormalize product data, AP internal inbox, OAuth scraper auth

Remove cross-DB relationships (CartItem.product, CartItem.market_place,
OrderItem.product) that break with per-service databases. Denormalize
product and marketplace fields onto cart_items/order_items at write time.

- Add AP internal inbox infrastructure (shared/infrastructure/internal_inbox*)
  for synchronous inter-service writes via HMAC-authenticated POST
- Cart inbox blueprint handles Add/Remove/Update rose:CartItem activities
- Market app sends AP activities to cart inbox instead of writing CartItem directly
- Cart services use denormalized columns instead of cross-DB hydration/joins
- Add marketplaces-by-ids data endpoint to market service
- Alembic migration adds denormalized columns to cart_items and order_items
- Add OAuth device flow auth to market scraper persist_api (artdag client pattern)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cart/bp/cart/global_routes.py

@@ -7,7 +7,6 @@ from sqlalchemy import select
 
 from shared.models.market import CartItem
 from shared.models.order import Order
-from shared.models.market_place import MarketPlace
 from shared.infrastructure.actions import call_action
 from .services import (
     current_cart_identity,
@@ -265,16 +264,14 @@ def register(url_prefix: str) -> Blueprint:
                                     required=False) if raw_pc else None
             if post:
                 g.page_slug = post["slug"]
-                result = await g.s.execute(
-                    select(MarketPlace).where(
-                        MarketPlace.container_type == "page",
-                        MarketPlace.container_id == post["id"],
-                        MarketPlace.deleted_at.is_(None),
-                    ).limit(1)
-                )
-                mp = result.scalar_one_or_none()
-                if mp:
-                    g.market_slug = mp.slug
+                # Fetch marketplace slug from market service
+                mps = await fetch_data(
+                    "market", "marketplaces-for-container",
+                    params={"type": "page", "id": post["id"]},
+                    required=False,
+                ) or []
+                if mps:
+                    g.market_slug = mps[0].get("slug")
 
         if order.sumup_checkout_id:
             try: