Show T5 products in the client's shop; keep float IDs and unknown paths off IMVU

The shop's T5 filter (maturity_rating "t5") is answered from the hub's products, fetched so they can be
shown and tried on; buying T5 products adds them to the hub library, and product.php details for
community products are answered here.

The client sends some product IDs as floats ("2000000008.0"): product.php passed the worn community
product to IMVU that way. Every ID is now read either way, and products.Guard refuses any request to
IMVU that still names a local ID given out. T5DE_PROXY_DUMP logs request and response bodies.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

internal/products/ids.go

@@ -0,0 +1,22 @@
+package products
+
+import (
+	"math"
+	"strconv"
+	"strings"
+)
+
+// parseID reads a product ID as the client writes it: "2000000008", or as a float, "2000000008.0" (its JavaScript
+// numbers go through Python as floats). Every place that takes community products out of what IMVU gets uses it, so a
+// float can't slip through as "not a product ID".
+func parseID(s string) (int64, bool) {
+	s = strings.TrimSpace(s)
+	if id, err := strconv.ParseInt(s, 10, 64); err == nil {
+		return id, true
+	}
+	f, err := strconv.ParseFloat(s, 64)
+	if err != nil || f != math.Trunc(f) || math.Abs(f) > 1<<53 {
+		return 0, false
+	}
+	return int64(f), true
+}