feat: boutique + zones (égouts, désert) + 10 monstres + 14 items + potions

Shop module: GET /api/shop, POST /api/shop/buy/:id, POST /api/shop/sell/:id
Potions: achat instantané, heal 50% HP, pas d'inventaire.
Items: buyPrice + minLevel + zone ajoutés à l'entité.
12 équipements (4 par zone: marais/égouts/désert) + 2 potions.

Monstres: zone field ajouté, 10 nouveaux monstres:
  Égouts (lv4-10): Rat, Slime, Araignée, Crocodile, Roi des Rats
  Désert (lv8-15): Scorpion, Vautour, Momie, Ver des Sables, Sphinx

Frontend: page /shop groupée par zone, rarity colors, achat/vente.
Sidebar: icône ShoppingBag pour la boutique.

src/shop/shop.controller.ts

@@ -0,0 +1,42 @@
+import { Controller, Get, Post, Param, Req, UseGuards, BadRequestException } from '@nestjs/common';
+import { ShopService } from './shop.service';
+import { AuthGuard } from '../auth/guards/auth.guard';
+import { Request } from 'express';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+import { Character } from '../character/entities/character.entity';
+
+@Controller('shop')
+@UseGuards(AuthGuard)
+export class ShopController {
+  constructor(
+    private readonly shopService: ShopService,
+    @InjectRepository(Character)
+    private readonly characterRepo: Repository<Character>,
+  ) {}
+
+  @Get()
+  async getCatalogue(@Req() req: Request) {
+    const char = await this.getCharacter(req);
+    return this.shopService.getCatalogue(char.id);
+  }
+
+  @Post('buy/:itemId')
+  async buy(@Param('itemId') itemId: string, @Req() req: Request) {
+    const char = await this.getCharacter(req);
+    return this.shopService.buy(itemId, char.id);
+  }
+
+  @Post('sell/:charItemId')
+  async sell(@Param('charItemId') charItemId: string, @Req() req: Request) {
+    const char = await this.getCharacter(req);
+    return this.shopService.sell(charItemId, char.id);
+  }
+
+  private async getCharacter(req: Request): Promise<Character> {
+    const user = (req as any).user;
+    const character = await this.characterRepo.findOne({ where: { userId: user.id } });
+    if (!character) throw new BadRequestException('Aucun personnage trouvé');
+    return character;
+  }
+}