[PROMO-007] Promotions: Discount rules engine (%, fixed, BOGO)

## Overview
Build the discount rules engine that powers all promotional features. This is the foundational promotions issue — all other promo tickets depend on it.

## Acceptance Criteria
- [ ] Support rule types: percentage off, fixed amount off, BOGO (buy one get one), free shipping threshold
- [ ] Rules can target: all products, specific categories, specific SKUs, or minimum cart value
- [ ] `POST /api/promotions/evaluate` — accepts cart contents, returns applied discounts and updated totals
- [ ] Rules have start/end dates and can be enabled/disabled
- [ ] Rules are composable (multiple discounts can stack, or be set as exclusive)
- [ ] Admin-only `POST /api/admin/promotions` to create/edit rules
- [ ] Unit test coverage for all rule types and edge cases (empty cart, rule expiry)

## Technical Notes
Treat this as a pure service/library — it should be stateless and testable independently of the cart or checkout flow.

## Depends On
- #5 AUTH-001 — admin rule management requires authenticated admin role
- #3 CART-003 — evaluates real cart contents

## Blocks
- #12 PROMO-008 (Flash Sale page reads from this engine)
- #13 PROMO-009 (coupon codes are a rule type)