fix!(lua.endpoints): allow use/sell consumables during SMODS_BOOSTER_OPENED

The `use` and `sell` endpoints reject valid actions during `SMODS_BOOSTER_OPENED` that the game actually permits. Verified against the patched source in `vendors/lovely/dump/`.

## `use` — missing state entirely

`src/lua/endpoints/use.lua` has `requires_state = { SELECTING_HAND, SHOP }`, so using a consumable from inventory while a pack is open is blocked with `INVALID_STATE`.

The game explicitly allows it. SMODS patches `Card:can_use_consumeable` (`card.lua:1818` in the dump) to include the state:

```lua
if G.STATE == G.STATES.SELECTING_HAND or G.STATE == G.STATES.TAROT_PACK
or G.STATE == G.STATES.SPECTRAL_PACK or G.STATE == G.STATES.PLANET_PACK
or G.STATE == G.STATES.SMODS_BOOSTER_OPENED then
```

Using an inventory consumable mid-pack is a non-destructive interrupt (`TAROT_INTERRUPT`): `use_card` saves `prev_state`, runs the consumable, then restores the pack — `G.GAME.pack_choices` is unchanged and the pack stays open (`functions/button_callbacks.lua:2291-2305`).

## `sell` — wrongly restricted to Buffoon packs

`src/lua/endpoints/sell.lua:58-72` rejects every sell unless the open pack is a Buffoon pack:

```lua
if G.STATE == G.STATES.SMODS_BOOSTER_OPENED then
... if pack_set ~= "Joker" then
send_response({ message = "Can only sell jokers when a Buffoon pack is open", ... })
```

The game has no such restriction. `Card:can_sell_card` (`card.lua:1896` in the dump) only checks `area.config.type == joker` — and `G.consumeables` is created with `type = 'joker'` (`game.lua:2291`), so **jokers and consumables** are sellable during **any** pack type. Freeing a slot before picking from a pack is intended gameplay.

## Fix

1. `use.lua`: add `G.STATES.SMODS_BOOSTER_OPENED` to `requires_state`. Existing `max_highlighted` target logic already matches the game. Hand-target consumables only apply when the pack exposes a hand (`draw_hand` packs — same condition `rearrange.lua:88-89` already uses).
2. `sell.lua`: remove the Buffoon-only guard; keep the universal `can_sell_card` checks (not during play, not eternal).

Both gaps are untested — `test_sell.py` has no `SMODS_BOOSTER_OPENED` cases; `test_use.py` asserts `NOT_ALLOWED` in states the game permits.

Ref: #156 (subset — sell joker in Buffoon pack)