Show T5 products in the client's shop; keep float IDs and unknown paths off IMVU

The shop's T5 filter (maturity_rating "t5") is answered from the hub's products, fetched so they can be
shown and tried on; buying T5 products adds them to the hub library, and product.php details for
community products are answered here.

The client sends some product IDs as floats ("2000000008.0"): product.php passed the worn community
product to IMVU that way. Every ID is now read either way, and products.Guard refuses any request to
IMVU that still names a local ID given out. T5DE_PROXY_DUMP logs request and response bodies.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

internal/products/products_test.go

@@ -73,6 +73,17 @@ func (f *fakeIMVU) RoundTrip(r *http.Request) (*http.Response, error) {
 		return reply(`{"status": "success"}`)
 	}
 	switch r.URL.Path {
+	case "/api/shop/product.php":
+		checkSigned(false)
+		f.record("product info", body)
+		return reply(`{"products": [{"id": "12345", "name": "IMVU's"}]}`)
+	case "/api/shop/search_st.php":
+		f.record("search", body)
+		return reply(`{"keys": [], "result": {}}`)
+	case "/api/service/shop/svc_catalog_purchase.php":
+		checkSigned(false)
+		f.record("purchase", body)
+		return reply(`{"status": 1, "balance_credits": 10, "balance_promo": 0}`)
 	case "/api/outfits.php":
 		if len(body) > 0 {
 			checkSigned(false)