Show T5 products in the client's shop; keep float IDs and unknown paths off IMVU

The shop's T5 filter (maturity_rating "t5") is answered from the hub's products, fetched so they can be
shown and tried on; buying T5 products adds them to the hub library, and product.php details for
community products are answered here.

The client sends some product IDs as floats ("2000000008.0"): product.php passed the worn community
product to IMVU that way. Every ID is now read either way, and products.Guard refuses any request to
IMVU that still names a local ID given out. T5DE_PROXY_DUMP logs request and response bodies.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

README.md

@@ -44,7 +44,8 @@ itself:
   checksum): for a product deriving from an IMVU product, IMVU is asked about the parent and the proxy adds its own
   entry (the client needs the parent's derivation chain).
 - `productdata/<local ID>/<revision>`: the pack built into a CFL.
-- `api/shop/product.php` (putting a product on asks whether it's a bundle).
+- `api/shop/product.php`: putting a product on asks whether it's a bundle (not), and the shop asks for product
+  details (answered from the hub's listing, or the pack; IMVU is asked only about its own products).
 
 IMVU never sees community products: they're taken out of outfit saves (`api/base_look.php`) and outfit chat
 commands (`*use`, `*putOn`, `*putOnOutfit`, `*remove`, `*takeOff` on `/chat/` queues; a command left empty is
@@ -53,6 +54,9 @@ products with the outfit they were saved with, and adds them back when the clien
 (`base_look.php`, and `look` in the login response); an outfit changed elsewhere comes back without them.
 Requests it changes are re-signed (`X-imvu-auth`) with the session key from the login response, which never
 leaves the machine.
+The client sends some product IDs as floats (`2000000008.0`), so every ID is read either way (`parseID`). As a
+last check, `products.Guard` refuses any request to IMVU that still names a local ID given out, and logs it
+(`products: refused a request to ...`): such a request is a path not handled yet.
 
 ## The hub
 
@@ -69,6 +73,17 @@ and what they wear; the proxy gives the client those of their products it has pa
 from them, and adds them to the whole outfits they send. It also keeps community products out of the outfit the
 client posts to IMVU's chat participant endpoint.
 
+The shop (the client's `t5de-shop` patch adds a T5 choice to its rating filter): searches with
+`maturity_rating` `t5` (`api/shop/search_st.php`) are answered from the hub's products (`GET /api/v1/products`,
+filtered by the shop's categories against each product's IMVU parent's category path), fetching listed products
+that aren't here yet (up to 15 seconds) so they can be shown and tried on. Buying T5 products
+(`api/service/shop/svc_catalog_purchase.php`) adds them to the person's hub library; IMVU products in the same
+purchase go on to IMVU without them.
+
+For finding out what IMVU's APIs send, `T5DE_PROXY_DUMP=<text>` logs the request and response bodies of requests
+whose path contains it (test accounts only: bodies hold personal data). In Git Bash, keep the value from starting
+with `/` (or set `MSYS_NO_PATHCONV=1`), or it's turned into a Windows path.
+
 ## Building
 
     go test ./...