Decouple cart/market DBs: denormalize product data, AP internal inbox, OAuth scraper auth

Remove cross-DB relationships (CartItem.product, CartItem.market_place,
OrderItem.product) that break with per-service databases. Denormalize
product and marketplace fields onto cart_items/order_items at write time.

- Add AP internal inbox infrastructure (shared/infrastructure/internal_inbox*)
  for synchronous inter-service writes via HMAC-authenticated POST
- Cart inbox blueprint handles Add/Remove/Update rose:CartItem activities
- Market app sends AP activities to cart inbox instead of writing CartItem directly
- Cart services use denormalized columns instead of cross-DB hydration/joins
- Add marketplaces-by-ids data endpoint to market service
- Alembic migration adds denormalized columns to cart_items and order_items
- Add OAuth device flow auth to market scraper persist_api (artdag client pattern)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

market/scrape/persist_api/save_nav.py

@@ -1,17 +1,17 @@
-# replace your existing upsert_product with this version
-
 import os
 import httpx
 
 from typing import Dict
 
+from ..auth import auth_headers
+
 async def save_nav(
     nav: Dict,
 ):
     sync_url = os.getenv("SAVE_NAV_URL", "http://localhost:8001/market/suma-market/api/products/nav/")
 
     async with httpx.AsyncClient(timeout=httpx.Timeout(20.0, connect=10.0)) as client:
-        resp = await client.post(sync_url, json=nav)
+        resp = await client.post(sync_url, json=nav, headers=auth_headers())
     # Raise for non-2xx
     resp.raise_for_status()
     data = resp.json() if resp.content else {}