feat(api): isolated user map space with ownership and quotas (#24)

[Aduersarius]

Closes #24.

Summary

• Reserves user map IDs 600–999 (gap after local static 500–599, before challenges 2000+).
• Adds user_maps table with ownership, statuses (draft|proposed|published|archived), density counters, and asset byte tracking.
• Enforces per-account quotas (maps/NPCs/objects/assets), owner-only edits (403), draft visibility isolation, and v1 economy isolation (no combat/exp/gold; bans valuables; blocks official-world portals).
• Documents the range in frontend/utils/gameLoader.ts (USER_MAP_ID_MIN/MAX, isUserCreatedMapId).
• Unit + integration tests for range, economy policy, ownership, quotas, and draft visibility.

Differentiation vs #60

• feat(api): isolated user map space, ownership enforcement and quotas (#24) #60 is a kitchen-sink services stub on range 1000–1999 mixed with unrelated FE/protocol/converter work.
• This PR is scoped: real schema + repository + HTTP routes + frontend range helpers only, using the unused 600–999 band and explicit economy isolation.

Verification

• Tests: api/src/tests/user-maps.unit.test.ts, api/src/tests/user-maps.integration.test.ts (integration no-ops without DB).
• Local install/tsc blocked in agent session; CI should cover compile/test.

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar