feat: unlocks, inventory items, sigils, drops, and essence (Workstream C)

Implements the backend REST surface and WS wiring for
docs/superpowers/specs/2026-07-23-character-depth-ghost-log-design.md's
Workstream C:

- New models: UnlockRecord (unlocks), InventoryItem (inventory_items),
  Sigil (sigils) — brand-new tables, picked up by main.py's existing
  create_all.
- New app/inventory.py: unlock price table, item drop table/odds,
  essence economy constants, sigil design validation, and an atomic
  (row-locked) purchase_unlock() that guards against double-spend races.
- New app/routes/inventory.py: GET unlocks/items/sigils, POST sigils
  (validates the placeholder {points, rune} shape, points capped at 12),
  POST unlocks/{unlock_key} (402 on insufficient essence, 404 on unknown
  key, idempotent re-buy).
- GET /auth/me now includes unlocks: list[str] and essence: int.
- ws.py: wires essence trickle + item_drop rolls into the one trigger
  point that exists in this worktree today (_handle_summon, covering
  every successful summon plus high-rarity summons); the other two
  contract trigger points (correct judgment, successful ritual) belong
  to Workstream B's not-yet-landed ritual/judgment WS handlers, which
  should call app.inventory's same helpers once they land.
- User.essence: int added (Workstream B owns this column per the spec;
  added here per orchestrator instruction so this workstream is
  independently testable — merge controller reconciles the duplicate
  edit).

Also fast-forwarded this worktree's branch onto master (it had fallen
behind several commits) so the files this workstream depends on
(shop.py, ws.py, entities.py, etc.) were actually present to build
against.

Tests: 109 passed (drop-roll statistical sanity with seeded RNG,
inventory/sigil CRUD, purchase success/insufficient-funds/idempotency/
unknown-key paths, /auth/me shape, ws summon-trickle and item-drop
wiring).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/schemas.py

@@ -1,4 +1,5 @@
 import uuid
+from datetime import datetime
 
 from pydantic import BaseModel, ConfigDict, Field
 
@@ -12,6 +13,8 @@ class RegisterRequest(BaseModel):
 class UserOut(BaseModel):
     id: uuid.UUID
     username: str
+    essence: int = 0
+    unlocks: list[str] = Field(default_factory=list)
 
     model_config = ConfigDict(from_attributes=True)
 
@@ -19,3 +22,40 @@ class UserOut(BaseModel):
 class LoginRequest(BaseModel):
     username: str
     password: str
+
+
+class UnlockOut(BaseModel):
+    unlock_key: str
+    unlocked_at: datetime
+
+    model_config = ConfigDict(from_attributes=True)
+
+
+class PurchaseOut(BaseModel):
+    unlock_key: str
+    unlocked_at: datetime
+    essence: int
+
+
+class InventoryItemOut(BaseModel):
+    id: uuid.UUID
+    item_type: str
+    item_key: str
+    payload: dict
+    obtained_at: datetime
+
+    model_config = ConfigDict(from_attributes=True)
+
+
+class SigilIn(BaseModel):
+    name: str = Field(min_length=1, max_length=64)
+    design: dict
+
+
+class SigilOut(BaseModel):
+    id: uuid.UUID
+    name: str
+    design: dict
+    created_at: datetime
+
+    model_config = ConfigDict(from_attributes=True)