feat(wardrobe): module foundation — garments + outfits space-scoped data layer (M1)

M1 of docs/plans/wardrobe-module.md — pure data layer + backend plumbing,
zero UI (that's M2). A user can now hold a digital wardrobe per space:
brand merch, club Trikots, family Kleiderschrank, team Kostüme, practice
Dresscode, and personal closet all live as separate pools under the same
Dexie tables, space-scoped like tags/scenes/agents after Phase 2c.

Data model — two tables, no join:

- wardrobeGarments (Dexie v41): single clothing items / accessories.
  Indexed on `category` + `createdAt` + `isArchived`. Encrypted:
  name/brand/color/size/material/tags/notes. Plaintext: category,
  mediaIds, counters, timestamps — all indexed or structural.
  `mediaIds[0]` is the primary photo used for try-on; additional
  ids are alternate views (back, detail) for M7.

- wardrobeOutfits (Dexie v41): named compositions referencing
  garment ids. Encrypted: name/description/tags. Plaintext:
  garmentIds (FK array), occasion (closed enum — useful for
  undecrypted filtering), season, booleans, lastTryOn snapshot.

- picture.images gains `wardrobeOutfitId?: string | null` as a
  plaintext back-reference. Try-on results land in the Picture
  gallery like any other generation; the outfit detail view
  queries them via this id rather than maintaining a third table.

Space scope:

- `wardrobe` added to all five explicit allowlists in shared-types/
  spaces.ts (personal is wildcard, no edit needed). Each space type
  gets a one-line comment explaining the real-world use case.
- App registry: `wardrobe` entry in shared-branding/mana-apps.ts
  with a rose→fuchsia gradient icon (T-shirt on hanger silhouette),
  color #e11d48, tier 'beta', status 'beta'.
- Module registry: wardrobeModuleConfig imported + appended to
  MODULE_CONFIGS so SYNC_APP_MAP picks it up automatically.

Backend:

- MAX_REFERENCE_IMAGES bumped 4 → 8 in picture/generate-with-
  reference (plus the client-side default in ReferenceImagePicker).
  Justified with a comment: face + body + top + bottom + shoes +
  outerwear + 2 accessories = 8. Cost doesn't scale with ref count
  (OpenAI bills per output), so the bump is a pure capability
  expansion with no credit-side risk.
- New POST /api/v1/wardrobe/garments/upload wraps uploadImageToMedia
  with app='wardrobe'. Registered under /api/v1/wardrobe in index.ts.
  Pattern 1:1 with the profile/me-images/upload endpoint; tier-gating
  falls out of wardrobe NOT being in RESOURCE_MODULES (tier='guest'
  works — consistent with picture's plain CRUD).

Stores emit domain events (WardrobeGarmentAdded, WardrobeOutfitCreated,
WardrobeOutfitTryOn, etc.) so later mana-ai missions can observe
activity without polling.

No UI in this commit. M2 (Garments-Grundlayer) wires the route + grid
+ upload-zone; M3 the Outfit composer; M4 the Try-On integration.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/api/src/lib/metrics.ts

@@ -0,0 +1,106 @@
+/**
+ * Prometheus metrics for mana-api.
+ *
+ * Follows the same shape as mana-ai (default metrics with a service
+ * prefix, plus module-specific counters / histograms). Scraped from
+ * GET /metrics — mounted unauthenticated since the surface is
+ * internal-network only.
+ *
+ * Naming convention: `mana_api_<module>_*`. Underscore separators,
+ * standard Prometheus regex `[a-zA-Z_:][a-zA-Z0-9_:]*`.
+ */
+
+import { Counter, Histogram, Registry, collectDefaultMetrics } from 'prom-client';
+
+export const register = new Registry();
+register.setDefaultLabels({ service: 'mana-api' });
+collectDefaultMetrics({ register, prefix: 'mana_api_' });
+
+// ── Website module ──────────────────────────────────────
+
+/**
+ * Every call to POST /sites/:id/publish. `result` labels:
+ *   - `success`     — snapshot stored, is_current flipped
+ *   - `slug_taken`  — another site already has this slug live
+ *   - `invalid`     — validation error (bad slug, missing fields)
+ *   - `error`       — unexpected failure (DB, network)
+ */
+export const websitePublishTotal = new Counter({
+	name: 'mana_api_website_publish_total',
+	help: 'Publish attempts against the website module.',
+	labelNames: ['result'] as const,
+	registers: [register],
+});
+
+export const websitePublishDuration = new Histogram({
+	name: 'mana_api_website_publish_duration_seconds',
+	help: 'End-to-end latency of the publish flow (validation + DB transaction).',
+	buckets: [0.05, 0.1, 0.25, 0.5, 1, 2, 5],
+	registers: [register],
+});
+
+/**
+ * Form submissions received on the public endpoint. `result` labels:
+ *   - `received`    — stored in submissions table
+ *   - `spam`        — honeypot tripped, silent-dropped
+ *   - `rate_limit`  — IP rate-limit hit
+ *   - `not_found`   — slug or block missing
+ *   - `invalid`     — payload validation failed
+ */
+export const websiteSubmissionsTotal = new Counter({
+	name: 'mana_api_website_submissions_total',
+	help: 'Form submissions received on the website submit endpoint.',
+	labelNames: ['result'] as const,
+	registers: [register],
+});
+
+/**
+ * Host resolver lookups from hooks.server.ts. `result` labels:
+ *   - `hit`   — verified binding found, slug returned
+ *   - `miss`  — hostname not bound, 404
+ *   - `error` — DB error
+ */
+export const websiteHostResolveTotal = new Counter({
+	name: 'mana_api_website_host_resolve_total',
+	help: 'Custom-host to slug resolutions hit / miss.',
+	labelNames: ['result'] as const,
+	registers: [register],
+});
+
+/**
+ * DNS verification runs. `result`:
+ *   - `verified` — both TXT + CNAME/A matched
+ *   - `failed`   — at least one check failed; reason in logs
+ */
+export const websiteDomainVerifyTotal = new Counter({
+	name: 'mana_api_website_domain_verify_total',
+	help: 'Custom-domain DNS verification attempts.',
+	labelNames: ['result'] as const,
+	registers: [register],
+});
+
+/**
+ * Public snapshot reads — how many visitors hit /public/sites/:slug.
+ * `result`:
+ *   - `hit`    — snapshot served
+ *   - `not_found` — unpublished or unknown slug
+ */
+export const websitePublicReadsTotal = new Counter({
+	name: 'mana_api_website_public_reads_total',
+	help: 'Reads of the public /public/sites/:slug endpoint.',
+	labelNames: ['result'] as const,
+	registers: [register],
+});
+
+/**
+ * Cache-header guidance for operators: how often public reads return
+ * a cache-purge-worthy freshly-published blob vs a routine read. We
+ * emit this via header inspection in the public route; `purge_needed`
+ * is a heuristic (new-snapshot age < 10s).
+ */
+export const websitePublicReadAge = new Histogram({
+	name: 'mana_api_website_public_read_age_seconds',
+	help: 'Age of the served snapshot at read time (seconds since publishedAt).',
+	buckets: [1, 10, 60, 300, 1800, 3600, 21600, 86400],
+	registers: [register],
+});