feat(economy): add vanity shop and harden economy money-safety

Vanity shop (/vanity): cosmetic badges/titles as a pure whale coin sink -
purchases burn coins (not credited to the house) and equip a badge shown on
/profile. New vanity_owned/vanity_active fields, schema sync, and tests.

Money-safety and robustness fixes from a codebase review:

- _parse_amount now rejects negative amounts. Every bet/give/request flows
  through it, so a negative value can no longer mint coins on a loss/transfer
  path that trusts the caller's sign (all call sites already guarded <= 0;
  this closes the source).
- do_blackjack_payout no longer raises on a DB failure. The stake was already
  deducted in do_blackjack_bet, so it now logs critical with the owed amount
  (for admin reconciliation) and returns db_error; all payout call sites render
  a clear "payout failed" notice instead of crashing the interaction.
- Instant "kohv" consumable now cancels the pending reminder DMs for the
  cooldowns it wipes (via new INSTANT_RESET_COMMANDS), so no stale/duplicate
  reminders fire.
- Renamed the misleadingly-named _refund_user_safe -> _debit_house_safe (it
  debits the house) and dropped its ignored first arg.
- Added __all__ to vanity.py and consumables.py so `import *` no longer leaks
  incidental imports into the economy namespace.
- Documented Kõrvaklapid's +25 coin daily bonus in README and DEV_NOTES.

Tests: blackjack payout DB-failure safety and INSTANT_RESET_COMMANDS lockstep.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013VbAVsrZuYesea99mPMmPT

tests/test_money_safety_fixes.py

@@ -10,6 +10,7 @@ Covers the two pure-logic fixes:
 from datetime import datetime, timedelta, timezone
 
 from core import economy
+from core.pb_client import DatabaseError
 
 from conftest import run
 
@@ -89,3 +90,26 @@ class TestBailIdempotency:
         self._jail(fake_pb, now, balance=1000)
         res = run(economy.do_bail(UID))
         assert res["ok"] and res["fine"] >= economy.MIN_BAIL
+
+
+class TestBlackjackPayoutSafety:
+    """do_blackjack_payout must not raise on a DB failure - the stake was already
+    deducted in do_blackjack_bet, so a raised exception would blow up the
+    interaction handler and swallow the outcome. It reports db_error instead."""
+
+    async def _boom(self, *args, **kwargs):
+        raise DatabaseError("simulated PocketBase outage")
+
+    def test_payout_returns_db_error_when_read_fails(self, fake_pb, monkeypatch):
+        monkeypatch.setattr(economy.gambling, "get_user", self._boom)
+        res = run(economy.do_blackjack_payout(UID, payout=200, total_invested=100))
+        assert res == {"ok": False, "reason": "db_error"}
+
+    def test_payout_returns_db_error_when_commit_fails(self, fake_pb, monkeypatch):
+        run(economy.get_user(UID))
+        fake_pb.record_for(UID)["balance"] = 500
+        monkeypatch.setattr(economy.gambling, "_commit", self._boom)
+        res = run(economy.do_blackjack_payout(UID, payout=200, total_invested=100))
+        assert res == {"ok": False, "reason": "db_error"}
+        # The failed credit did not persist; balance is untouched (no partial win).
+        assert fake_pb.record_for(UID)["balance"] == 500