fix(market-subgraph)!: hold Market.items to the 100-item batch cap and require Market.catalog's category

[Hebilicious]

Closes #10
Closes #11

What changed

• S3 (Market.items(ids:) bypasses the 100-item summary batch cap #10):
  • MARKET_SUMMARY_BATCH_LIMIT and MarketSummaryBatchLimitError move into requestScopedMarketReader (market-reader.ts). It refuses a summary read over 100 distinct items before it reaches Pearl Abyss.
  • Market.items(ids:) and Item.marketSummary now share one rule and one QUERY_BUDGET_EXCEEDED error.
  • The error wrapper now sits outside the request-scoped reader so it can map that refusal.
• S4 (Market.catalog without a category can never succeed (180 upstream calls against a 50 budget) #11):
  • Market.catalog(category:) is required in the schema, and its description says what a main category reads.
  • isPearlAbyssMarketCategory (pearl-abyss/protocol/categories.ts) turns an unknown category into a BAD_USER_INPUT error that names it, such as Unknown Central Market category: main 1, sub 99. Before, it was an internal error.
• The schema artifacts are regenerated.
• docs/api.md is updated.
• New market-error-semantics scenarios, plus the two category rows of market-client-input-errors.

How it was reproduced

I ran this layer's market-error-semantics feature against the parent layer (audit/throttle-and-budget-errors):

Scenario	On the parent
market-items-summary-batch-limit (101 IDs)	fails: AssertionError: the answer has no errors. All 101 IDs went upstream in one batch
market-catalog-needs-category	fails: the query is accepted and refused at run time with The query needs more Pearl Abyss requests than this deployment's subrequest limit allows…, not answered 400 as invalid for the schema. This is the 180-pair read against a 50-request budget
market-client-input-errors (category rows)	fails: {"message":"The market subgraph could not answer this field.", … "code":"INTERNAL_SERVER_ERROR"} for main: 0, not BAD_USER_INPUT
market-items-summary-batch-at-limit (100 IDs)	passes
every earlier scenario	passes

Not reproduced

• market-items-summary-batch-at-limit passes on the parent. It guards that exactly 100 IDs still go in one upstream request.
• The audit's live observations against the demo were not repeated, because there is no live traffic:
  • 150 IDs answered in one upstream call;
  • catalog without a category answered 503.

Refs #21 (security audit tracking issue). Part of stack #42; review bottom-up, each layer shows only its own diff.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2e17466

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR