fix(extensions): close three contract gaps found building the first extension

[Taure]

Three gaps asobi_quests hit as the first real extension built against the
machinery merged in #359. Closes #360, closes #361, closes #362.

#360 - an extension cannot mint an error code

asobi_extension gains an optional codes/0:

codes() -> #{~"quests.already_claimed" =>
               #{status => 409, message => ~"This quest was already claimed."}}.

Shape, and why. The ticket offered a register_codes/1 call or a manifest
callback. The callback wins because it is checkable before boot and needs no
process, but the merge direction matters more than the declaration:

• asobi_extensions:resolve/0 builds one Code => {Status, Message} map into
  persistent_term from validated manifests. asobi_error reads it; it never
  calls resolve/0. Nothing pushes into asobi_error, so the only writer is
  the resolve path and the set is closed per deployment - a string arriving in
  a request or a Lua script still cannot become a code. The literal-code rule
  asobi_error_contract_tests enforces over core is unchanged.
• A code domain now claims the rpc namespace exactly as an RPC prefix does,
  since they are the same token by construction. That gets the whole
  reservation for free: storage.wedged is refused as reserved, a domain
  outside owns.rpc is an undeclared claim, and two extensions in one domain
  collide. No second mechanism.
• asobi_error:core_codes/0 is new and is what asobi_extension_reserved
  derives from. Deriving from codes/0 once extension codes are installed
  would tell quests it may not claim quests - latent today because check/0
  runs before the term is written, live the moment anything re-validates a
  booted node.

A code the extension did not declare is still 500 and still logs
undefined_error_code. Owning the domain does not mint every code inside it.

#362 - no raw-query escape hatch

asobi_repo:increment/3, not query/2:

{ok, Row} = asobi_repo:increment(asobi_quest_progress,
                                 #{player_id => P, quest_id => Q},
                                 #{counter => 1}).

One INSERT ... ON CONFLICT ... DO UPDATE SET counter = t.counter + EXCLUDED.counter, with the insert half so the first event does not need an
insert-then-retry - which is the race the primitive exists to remove.

Why not the two-line query/2 the ticket proposed. A raw-SQL hole in the
data seam is an injection surface the moment any part of it takes a
caller-supplied string, and on a library that surface is permanent. The shape
here makes it structurally impossible: every identifier is a field of the
schema you pass, matched against Schema:fields() and rejected unless it is a
plain SQL name; every caller value is a bound parameter. query/2 could not
make that promise, and once it existed every extension would reach for it
rather than the safe primitive. If something else is not expressible, that is
a ticket against core, not a hole in the seam.

Where core has the same problem. Two sites, both named in the PR body
rather than changed:

• asobi_economy:acquire_wallet_lock/2 - pg_advisory_xact_lock, not a
  counter and not something a counter primitive should grow to cover.
• asobi_player_stats:bump/3 - the exact twin of the quests case. Left
  deliberately: bump/3 runs inside the transaction that makes a match final,
  and today a missing stats row is a 0-row UPDATE and a warning. Under an
  upsert a deleted player becomes a foreign-key violation, which in Postgres
  aborts the enclosing transaction and would take the match record with it.
  Worth doing, but behind its own change with its own test.

#361 - args length never checked against mfa arity

Confirmed: one guard clause. length(Args) =:= A in is_lua_binding/2, plus a
binding_problem/1 that names the mismatch instead of reporting it as a
generic malformed binding. Core's own asobi_fixture_quests_extension declared
status with args => [binary] and arity 2 - fixed to arity 1, and the same
mistake fixed in the guide's worked example.

Documentation drift

guides/extensions.md's "Two gaps you hit today" is gone: kura is pinned at
2.20.1, migrations run through asobi_repo:migration_apps/0 and
#kura_assoc.on_delete exists. The same stale claim in
asobi_repo:migration_apps/0's moduledoc and one test comment went with it.
The guide gains sections for error codes and counters.

Tests

12 new tests, each verified to fail when its fix is reverted:

Revert	Failing tests
entry/1 extension lookup	2
code domains claim rpc	3
codes_problems/1	2
core_codes/0 in the reserved set	1
length(Args) =:= A	1
+ EXCLUDED -> replace	1 eunit, 1 ct

asobi_repo_increment_SUITE runs against real Postgres. Its second case
(creates_the_row_when_it_is_missing) covers the insert half and passes under
the accumulate-revert, since only the conflict branch changes there.

fmt, xref, dialyzer, ex_doc clean. Full eunit 1418/0. ct for
asobi_repo_increment_SUITE, asobi_match_stats_SUITE and
asobi_economy_SUITE green.

[github-actions]

🟡 Code Coverage — 74.1%

6201 of 8374 lines covered.