Decouple cart/market DBs: denormalize product data, AP internal inbox, OAuth scraper auth

Remove cross-DB relationships (CartItem.product, CartItem.market_place,
OrderItem.product) that break with per-service databases. Denormalize
product and marketplace fields onto cart_items/order_items at write time.

- Add AP internal inbox infrastructure (shared/infrastructure/internal_inbox*)
  for synchronous inter-service writes via HMAC-authenticated POST
- Cart inbox blueprint handles Add/Remove/Update rose:CartItem activities
- Market app sends AP activities to cart inbox instead of writing CartItem directly
- Cart services use denormalized columns instead of cross-DB hydration/joins
- Add marketplaces-by-ids data endpoint to market service
- Alembic migration adds denormalized columns to cart_items and order_items
- Add OAuth device flow auth to market scraper persist_api (artdag client pattern)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cart/bp/data/routes.py

@@ -83,7 +83,6 @@ def register() -> Blueprint:
     # --- cart-items (product slugs + quantities for template rendering) ---
     async def _cart_items():
         from sqlalchemy import select
-        from sqlalchemy.orm import selectinload
         from shared.models.market import CartItem
 
         user_id = request.args.get("user_id", type=int)
@@ -98,13 +97,13 @@ def register() -> Blueprint:
             return []
 
         result = await g.s.execute(
-            select(CartItem).where(*filters).options(selectinload(CartItem.product))
+            select(CartItem).where(*filters)
         )
         items = result.scalars().all()
         return [
             {
                 "product_id": item.product_id,
-                "product_slug": item.product.slug if item.product else None,
+                "product_slug": item.product_slug,
                 "quantity": item.quantity,
             }
             for item in items