refactor(server): extract the shop routes + inject get_progression_content into the seam (R3)

The progression-content substrate: `_get_progression_content` (a lazy,
double-checked-locking content cache) is now published into the appstate seam as
a CALLABLE. The cache global + lock + the function stay in server.py (startup
uses it, and test_progression_api patches `server._progression_content`
directly), so ZERO test retargeting — routers just call
`appstate.get_progression_content()`.

Because the accessor is defined at server.py:1152 but the import-top configure()
runs at :346, a second `appstate.configure(get_progression_content=...)` publishes
it right after the def (configure is idempotent/additive).

First consumer: routers/shop.py (3 routes: buy/equip/list). Bodies verbatim;
@app -> @router, meta_db -> appstate.meta_db, _clean_str from reqfields,
_get_progression_content() -> appstate.get_progression_content(). This unblocks
stats/progression/profile next (all share the accessor).

server.py: 7,880 -> 7,845.

Verified: pyflakes clean; route table IDENTICAL (143); pytest 2401 passed
(test_progression_api's server._progression_content patch still works via the
kept cache); packaging guard; eslint 0. Boot smoke: GET /api/shop 200 (drives
appstate.get_progression_content), buy 400 on bad body.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

static/app.js

@@ -4877,15 +4877,6 @@ window.jucePlayer = jucePlayer;
     // value change (this runs on a 350ms poll — logging every tick would
     // flood the diagnostics buffer).
     let _loggedOutputType;
-    // [asio-diag] verbose diagnostics, gated on --debug (preload exposes
-    // audio.debugEnabled). Resolved once at install; until it resolves the
-    // flag stays false and verbose lines are skipped. Shared with the
-    // renderer-bus feeder below via window._asioDiagEnabled.
-    let _asioDiag = false;
-    if (typeof juceApi.debugEnabled === 'function') {
-        juceApi.debugEnabled().then((v) => { _asioDiag = !!v; }).catch(() => {});
-    }
-    window._asioDiagEnabled = () => _asioDiag;
     async function _outputIsExclusive() {
         if (typeof juceApi.getCurrentDevice !== 'function') {
             if (_loggedOutputType !== '<no-getCurrentDevice>') {
@@ -4901,15 +4892,6 @@ window.jucePlayer = jucePlayer;
             if (t !== _loggedOutputType) {
                 _loggedOutputType = t;
                 console.log('[feedpak-route] outputType=', JSON.stringify(t), '→ exclusive=', excl);
-                // [asio-diag] full device object on every type change — shows
-                // the exact strings the predicate saw (inputType vs outputType,
-                // device names, duplex), so a driver reporting a non-'ASIO'
-                // type name is visible in tester logs.
-                if (_asioDiag) {
-                    try {
-                        console.log('[asio-diag] getCurrentDevice=', JSON.stringify(dev));
-                    } catch (_) { /* circular/hostile object — skip */ }
-                }
             }
             return excl;
         } catch (e) {
@@ -5394,13 +5376,6 @@ window.jucePlayer = jucePlayer;
         if (typeof ctx.setSinkId !== 'function') throw new Error('setSinkId unsupported');
         await ctx.setSinkId(exclusive ? { type: 'none' } : '');
         if (ctx.state !== 'running') await ctx.resume().catch(() => {});
-        // [asio-diag] a context left on the default sink while the bus is
-        // engaged is exactly the "song on the wrong device" symptom — record
-        // every successful sink flip (failures throw and are logged upstream).
-        if (window._asioDiagEnabled?.()) {
-            console.log('[asio-diag] setSink:', exclusive ? 'null-sink' : 'default',
-                'state=', ctx.state, 'rate=', ctx.sampleRate);
-        }
     }
 
     async function _disengage() {
@@ -5471,24 +5446,6 @@ window.jucePlayer = jucePlayer;
                 else if (elementSong) want = 'element';
             }
 
-            // [asio-diag] full decision vector, change-gated (500ms poll —
-            // steady state must not flood the buffer). This is the feeder-side
-            // counterpart of the watcher's [feedpak-route] decision line: it
-            // shows WHY the bus did or didn't engage (exclusive predicate,
-            // stems graph presence, native transport ownership, element song).
-            if (window._asioDiagEnabled?.()) {
-                const d = 'running=' + running + ' exclusive=' + exclusive
-                    + ' stems=' + !!stems + ' songAudio=' + !!songAudio
-                    + ' juceMode=' + !!window._juceMode
-                    + ' elementSong=' + elementSong
-                    + ' want=' + want + ' mode=' + _mode;
-                if (d !== window._lastRendererBusDecision) {
-                    window._lastRendererBusDecision = d;
-                    console.log('[asio-diag] renderer-bus:', d);
-                }
-            }
-
-
             const stemsGraphChanged = _mode === 'stems' && stems !== _stemsGraph;
             if (want !== _mode || stemsGraphChanged) {
                 await _disengage();