feat(wardrobe): module foundation — garments + outfits space-scoped data layer (M1)

M1 of docs/plans/wardrobe-module.md — pure data layer + backend plumbing,
zero UI (that's M2). A user can now hold a digital wardrobe per space:
brand merch, club Trikots, family Kleiderschrank, team Kostüme, practice
Dresscode, and personal closet all live as separate pools under the same
Dexie tables, space-scoped like tags/scenes/agents after Phase 2c.

Data model — two tables, no join:

- wardrobeGarments (Dexie v41): single clothing items / accessories.
  Indexed on `category` + `createdAt` + `isArchived`. Encrypted:
  name/brand/color/size/material/tags/notes. Plaintext: category,
  mediaIds, counters, timestamps — all indexed or structural.
  `mediaIds[0]` is the primary photo used for try-on; additional
  ids are alternate views (back, detail) for M7.

- wardrobeOutfits (Dexie v41): named compositions referencing
  garment ids. Encrypted: name/description/tags. Plaintext:
  garmentIds (FK array), occasion (closed enum — useful for
  undecrypted filtering), season, booleans, lastTryOn snapshot.

- picture.images gains `wardrobeOutfitId?: string | null` as a
  plaintext back-reference. Try-on results land in the Picture
  gallery like any other generation; the outfit detail view
  queries them via this id rather than maintaining a third table.

Space scope:

- `wardrobe` added to all five explicit allowlists in shared-types/
  spaces.ts (personal is wildcard, no edit needed). Each space type
  gets a one-line comment explaining the real-world use case.
- App registry: `wardrobe` entry in shared-branding/mana-apps.ts
  with a rose→fuchsia gradient icon (T-shirt on hanger silhouette),
  color #e11d48, tier 'beta', status 'beta'.
- Module registry: wardrobeModuleConfig imported + appended to
  MODULE_CONFIGS so SYNC_APP_MAP picks it up automatically.

Backend:

- MAX_REFERENCE_IMAGES bumped 4 → 8 in picture/generate-with-
  reference (plus the client-side default in ReferenceImagePicker).
  Justified with a comment: face + body + top + bottom + shoes +
  outerwear + 2 accessories = 8. Cost doesn't scale with ref count
  (OpenAI bills per output), so the bump is a pure capability
  expansion with no credit-side risk.
- New POST /api/v1/wardrobe/garments/upload wraps uploadImageToMedia
  with app='wardrobe'. Registered under /api/v1/wardrobe in index.ts.
  Pattern 1:1 with the profile/me-images/upload endpoint; tier-gating
  falls out of wardrobe NOT being in RESOURCE_MODULES (tier='guest'
  works — consistent with picture's plain CRUD).

Stores emit domain events (WardrobeGarmentAdded, WardrobeOutfitCreated,
WardrobeOutfitTryOn, etc.) so later mana-ai missions can observe
activity without polling.

No UI in this commit. M2 (Garments-Grundlayer) wires the route + grid
+ upload-zone; M3 the Outfit composer; M4 the Try-On integration.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/api/src/modules/website/submit.ts

@@ -23,6 +23,7 @@
 import { Hono } from 'hono';
 import { and, eq } from 'drizzle-orm';
 import { db, publishedSnapshots, submissions } from './schema';
+import { websiteSubmissionsTotal } from '../../lib/metrics';
 
 const routes = new Hono();
 
@@ -142,6 +143,7 @@ routes.post('/submit/:siteSlug/:blockId', async (c) => {
 		c.req.header('x-forwarded-for')?.split(',')[0]?.trim() ??
 		'unknown';
 	if (rateLimitHit(`${siteSlug}:${ip}`)) {
+		websiteSubmissionsTotal.inc({ result: 'rate_limit' });
 		return c.json({ error: 'Rate limit überschritten — bitte später erneut versuchen' }, 429);
 	}
 
@@ -157,19 +159,23 @@ routes.post('/submit/:siteSlug/:blockId', async (c) => {
 		.limit(1);
 
 	if (!snapshotRow[0]) {
+		websiteSubmissionsTotal.inc({ result: 'not_found' });
 		return c.json({ error: 'Website nicht gefunden oder offline' }, 404);
 	}
 
 	const block = findFormBlock(snapshotRow[0].blob as SnapshotBlob, blockId);
 	if (!block) {
+		websiteSubmissionsTotal.inc({ result: 'not_found' });
 		return c.json({ error: 'Block nicht gefunden' }, 404);
 	}
 	if (!isFormBlock(block)) {
+		websiteSubmissionsTotal.inc({ result: 'invalid' });
 		return c.json({ error: 'Block ist kein Formular' }, 400);
 	}
 
 	const rawBody = (await c.req.json().catch(() => null)) as Record<string, unknown> | null;
 	if (!rawBody || typeof rawBody !== 'object') {
+		websiteSubmissionsTotal.inc({ result: 'invalid' });
 		return c.json({ error: 'Payload fehlt oder ungültig' }, 400);
 	}
 
@@ -178,6 +184,7 @@ routes.post('/submit/:siteSlug/:blockId', async (c) => {
 	// Form renderer. We also look for a generic "_trap" key.
 	const trap = rawBody.honeypot ?? rawBody._trap;
 	if (typeof trap === 'string' && trap.trim().length > 0) {
+		websiteSubmissionsTotal.inc({ result: 'spam' });
 		// Act as success to the bot, store nothing.
 		return c.json({ ok: true, spam: true }, 202);
 	}
@@ -188,6 +195,7 @@ routes.post('/submit/:siteSlug/:blockId', async (c) => {
 	for (const field of block.props.fields) {
 		const result = validateField(field, rawBody[field.name]);
 		if (!result.ok) {
+			websiteSubmissionsTotal.inc({ result: 'invalid' });
 			return c.json({ error: result.error, field: field.name }, 400);
 		}
 		cleaned[field.name] = result.value;
@@ -209,6 +217,7 @@ routes.post('/submit/:siteSlug/:blockId', async (c) => {
 		})
 		.returning({ id: submissions.id });
 
+	websiteSubmissionsTotal.inc({ result: 'received' });
 	return c.json({ ok: true, submissionId: row?.id ?? null }, 201);
 });