memba_appstore_v3 package

Package memba_appstore_v3 is a curated App Store for gno.land dApps: publishers pay a flat listing fee to register an app; a curator flips it live (or rejects it).

MONEY PATH (the only one): RegisterApp collects a flat `registrationFee` in ugnot and forwards 100% to the treasury in the SAME call — nothing is ever custodied. The safety contract mirrors memba_token_otc_v1 + the O-13 lesson:

1. IsUserCall() guard BEFORE reading OriginSend — an ephemeral `maketx run` realm can never attach unrecoverable coins (the guard agent_registry missed).
2. exact-coin via unsafe.OriginSend() (the coins on THIS call, not the wallet balance) — closes the overpay-trap and the wallet-balance bypass.
3. treasury-misconfig is fail-closed: an unset treasury panics (→ tx reverts → coins refunded), never silent custody.
4. CEI: state is written before the banker moves funds. All attacker-controlled input (screenshots, appURL scheme) is validated BEFORE OriginSend is read.
5. NewBanker(RealmSend, cur) sends the fee from the realm's own address to the treasury — no custody, no escrow (which is why no escrow is needed to be safe).

v3 over v2: a `rejected` state + RejectApp/EditListing lifecycle, ≤6 screenshots, an on-chain appURL scheme allowlist, FlagApp extended to pending listings (the public Unverified tab's safety valve), composite-key status/publisher indexes with O(1) per-status counters (so status/publisher reads are bounded, not full scans), and a sealed SeedListing migration primitive (FinalizeSeed closes the backdoor).

TREASURY: stored LOCALLY (admin-settable, 2-step handoff, defaults to the samcrew multisig) rather than read from memba_market_config — keeps the money path locally unit-testable. Keep it in sync with memba_market_config.GetTreasury().