Public ChestShop market REST endpoints (shops/items/stats)

Expose the public ChestShop market data that economy-explorer renders, as lightweight, cacheable, rate-limited REST endpoints under /api/v1/chestshop/** so external consumers can hit them hard without overloading the DB.

Endpoints (all public — no JWT; anonymous IP rate-limited):

• GET /api/v1/chestshop/shops — live shop directory from chestshop_shop (filters: itemKey, material, firmId, buyable, inStock, search; paged, limit≤100). Single indexed table; in-stock-then-cheapest ordering.
• GET /api/v1/chestshop/items — item directory with all-time aggregate stats (trade_count, total_quantity, total_volume) from chestshop_sale GROUP BY item_key; optional search; paged. Cached.
• GET /api/v1/chestshop/items/{itemKey} — per-item summary: windowed stats + cheapest live shops + daily price points. Cached.
• GET /api/v1/chestshop/stats — global market totals (sales, volume, distinct items). Cached (longer TTL).

Performance posture (the load constraint):

• Caffeine-backed Spring cache on the aggregate endpoints (compute once per short TTL).
• @RateLimit(anonymousPerMinute=…) caps scrapers (callers are anonymous via JwtAuthFilter#shouldNotFilter).
• Pagination caps + offset-overflow guard; only indexed filter columns.
• Deliberately EXCLUDES the financial-sensitive drilldowns economy-explorer login-gates (per-customer sales feed, per-seller/per-player money).

Tests:

• treasury-rest-api: through-DAL EmbeddedDbIT (MariaDB4j) — query/aggregation/pagination/validation, incl. chestshop_sale/chestshop_shop added to the embedded fixture.
• integration-tests: E2E restapi/ChestShopEndpointsTest — real in-game trade via ChestShopFixture, then hit the live endpoints and assert.

Both repos on develop.