feat(ads): VK post-move interstitial + retire deprecated hint_balance/paid_account

Interstitial video after a confirmed play or a hint, VK-only, offline
banner-only. The gate is client-mirrored: the backend puts the config
cooldowns (global 5m / vs_ai 30m / hint 1m) and a suppressed flag (the
no-ads / no_banner gate, same as the banner) on Profile.ads via adsFor;
the client self-gates on a per-kind last-shown time in localStorage, with
the VITE_ADS_STUB contour "ad fired" toast. Never fires after a pass,
exchange or resign. maybeShowInterstitial + vkShowInterstitial; the codec
and gateway transcode carry the ads block.

Also retires the deprecated accounts.hint_balance / paid_account domain
usage (expand-contract, code only — the columns stay for a later DROP so
image rollback stays DB-safe): drop the Account fields and their scan, the
dead account.SpendHint, account.GrantHints and the admin grant-hints
action; the in-game hint display now comes wholly from the payments hint
benefit. Banner eligibility and account merge no longer read the legacy
flags.

Tests: ads.test.ts (the client-mirrored gate), the codec ads round-trip,
the gateway ads transcode test, and a profile ads-config integration test
(cooldowns + suppressed under no-ads / no_banner). Docs: PAYMENTS §10 (+ru)
interstitial, the decision amends, backend README, the plan.

backend/internal/server/dto.go

@@ -60,6 +60,11 @@ type profileResponse struct {
 	// see the banner (a free account with an empty hint wallet and without the
 	// no_banner role), absent otherwise. See banner.go.
 	Banner *bannerDTO `json:"banner,omitempty"`
+	// Ads carries the post-move interstitial config for the client's client-mirrored gate: the
+	// cooldowns (seconds) and whether ads are suppressed in this context (no-ads / no_banner role).
+	// The client shows a VK interstitial after a confirmed move / hint when not suppressed and the
+	// cooldown has elapsed. Always present (the client also gates VK-only + online itself).
+	Ads *adsDTO `json:"ads,omitempty"`
 	// Email is the account's confirmed email address ("" when none); TelegramLinked and
 	// VkLinked report whether a platform identity is attached. They drive the profile's
 	// link / unlink / change-email controls, and are filled outside the pure projection
@@ -218,13 +223,15 @@ func sessionResponseFor(token string, acc account.Account) sessionResponse {
 // profileResponseFor projects an account into its profile DTO.
 func profileResponseFor(acc account.Account) profileResponse {
 	return profileResponse{
-		UserID:                 acc.ID.String(),
-		DisplayName:            acc.DisplayName,
-		PreferredLanguage:      acc.PreferredLanguage,
-		TimeZone:               acc.TimeZone,
-		AwayStart:              acc.AwayStart.Format(awayTimeLayout),
-		AwayEnd:                acc.AwayEnd.Format(awayTimeLayout),
-		HintBalance:            acc.HintBalance,
+		UserID:            acc.ID.String(),
+		DisplayName:       acc.DisplayName,
+		PreferredLanguage: acc.PreferredLanguage,
+		TimeZone:          acc.TimeZone,
+		AwayStart:         acc.AwayStart.Format(awayTimeLayout),
+		AwayEnd:           acc.AwayEnd.Format(awayTimeLayout),
+		// The hint balance comes from the payments benefit; profileResponse overrides this
+		// with the context-aware count. This zero is the fallback when that read fails.
+		HintBalance:            0,
 		BlockChat:              acc.BlockChat,
 		BlockFriendRequests:    acc.BlockFriendRequests,
 		IsGuest:                acc.IsGuest,