feat: product drafts, moderator edits with reasons and locks, info history, unlisted products and tags

New uploads are drafts: only their creator and moderators see them, nobody can get or wear them, and they're
deleted if not published within 30 days (their catalogs get delete changes). The creator reviews the info and
publishes it.

Editing a product's info is a permission check now (product:edit): moderators can edit anyone's with a reason the
creator sees, lock fields (product:lock; locked fields need product:edit-locked) and lower ratings
(product:rate-lower, not below its files'). Every change is kept in the product's info history, with who and why,
and can be undone by the same rules.

Products can be unlisted (out of search and lists, the link still works) and tagged; lists filter by tag and
catalog. The console has a Products section (everyone's for moderators, by status) and a drafts to-do.

A product's own category is left for later: the hub has no list of IMVU's categories to pick from.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/design.md

@@ -473,6 +473,8 @@ Phases for products, catalogs and imports (products.md, console.md, imports.md):
    **Done** (2026-11-05), except catalog deletion requests and the hosted rooms' scope, which come with cases
    (phase 3). Built-in roles are code (`apps/api/src/permissions.ts`); the `role` table comes with custom roles.
 2. Product info: drafts, moderator edits with reasons and locks, info history, unlisted products, tags and category.
+   **Done** (2026-11-05), except a product's own category: the hub has no list of IMVU's categories to choose from,
+   so products are filed under their parent's category path for now (later: IMVU's category tree, cached).
 3. Cases (reports, appeals, reviews), file blocks and the catalogs' changes feed; notifications; API tokens;
    two-factor sign-in for sensitive permissions.
 4. Imports: grants, recorded grants, requests, unclaimed creators, the job queue, `t5de-importer` (after its spike).