feat(admin): grant hints to a user's wallet from the console

Add an "Add hints" form on the admin user card that additively tops up a
player's hint wallet (1-100 per grant). The grant is raise-only by
construction (an additive UPDATE never lowers the balance) and stays correct
under a concurrent in-game spend; a per-grant cap bounds a fat-finger, since
the console can never reduce a wallet.

The in-game hint policy is unchanged and already correct: a game offers the
per-seat allowance plus the wallet, spending the allowance first and the
wallet only after (covered by TestHintPolicy).

backend/internal/inttest/admin_test.go

@@ -4,6 +4,7 @@ package inttest
 
 import (
 	"context"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -273,6 +274,76 @@ func TestConsoleThrottledViewAndFlagClear(t *testing.T) {
 	}
 }
 
+// TestConsoleGrantHints drives the admin hint-wallet grant end to end: the card shows the form,
+// the action is CSRF-guarded, a same-origin grant adds to the wallet, a second grant adds again
+// (rather than replacing), the inclusive per-grant cap is accepted, and an out-of-range or
+// non-numeric amount is refused without changing the balance.
+func TestConsoleGrantHints(t *testing.T) {
+	ctx := context.Background()
+	accounts := account.NewStore(testDB)
+	id := provisionAccount(t)
+	srv := server.New(":0", server.Deps{
+		Logger: zap.NewNop(), Accounts: accounts, Games: newGameService(), Registry: testRegistry, DictDir: dictDir(),
+	})
+	h := srv.Handler()
+	base := "http://admin.test/_gm/users/" + id.String()
+
+	if code, body := consoleDo(h, http.MethodGet, base, "", ""); code != http.StatusOK || !strings.Contains(body, "Add hints") {
+		t.Fatalf("user card = %d, has grant form = %v", code, strings.Contains(body, "Add hints"))
+	}
+	// The grant POST is CSRF-guarded like every console action.
+	if code, _ := consoleDo(h, http.MethodPost, base+"/grant-hints", "amount=5", ""); code != http.StatusForbidden {
+		t.Fatalf("grant without origin = %d, want 403", code)
+	}
+	// A same-origin grant adds to the wallet.
+	if code, body := consoleDo(h, http.MethodPost, base+"/grant-hints", "amount=5", "http://admin.test"); code != http.StatusOK || !strings.Contains(body, "now 5") {
+		t.Fatalf("grant 5 = %d, body has 'now 5' = %v", code, strings.Contains(body, "now 5"))
+	}
+	if acc, err := accounts.GetByID(ctx, id); err != nil || acc.HintBalance != 5 {
+		t.Fatalf("after grant 5: balance=%d err=%v, want 5", acc.HintBalance, err)
+	}
+	// A second grant adds again rather than replacing.
+	if code, body := consoleDo(h, http.MethodPost, base+"/grant-hints", "amount=3", "http://admin.test"); code != http.StatusOK || !strings.Contains(body, "now 8") {
+		t.Fatalf("grant 3 = %d, body has 'now 8' = %v", code, strings.Contains(body, "now 8"))
+	}
+	// An out-of-range or non-numeric amount is refused; the balance is left untouched.
+	for _, bad := range []string{"0", "-1", "101", "x", ""} {
+		if code, body := consoleDo(h, http.MethodPost, base+"/grant-hints", "amount="+bad, "http://admin.test"); code != http.StatusOK || !strings.Contains(body, "Invalid amount") {
+			t.Fatalf("grant %q = %d, has 'Invalid amount' = %v", bad, code, strings.Contains(body, "Invalid amount"))
+		}
+	}
+	if acc, err := accounts.GetByID(ctx, id); err != nil || acc.HintBalance != 8 {
+		t.Fatalf("after invalid grants: balance=%d err=%v, want 8", acc.HintBalance, err)
+	}
+	// The inclusive per-grant cap (100) is accepted.
+	if code, _ := consoleDo(h, http.MethodPost, base+"/grant-hints", "amount=100", "http://admin.test"); code != http.StatusOK {
+		t.Fatalf("grant 100 = %d, want 200", code)
+	}
+	if acc, err := accounts.GetByID(ctx, id); err != nil || acc.HintBalance != 108 {
+		t.Fatalf("after grant 100: balance=%d err=%v, want 108", acc.HintBalance, err)
+	}
+}
+
+// TestGrantHintsStore covers the wallet store method directly: an additive grant raises the
+// balance, a non-positive grant is rejected, and an unknown account yields ErrNotFound.
+func TestGrantHintsStore(t *testing.T) {
+	ctx := context.Background()
+	accounts := account.NewStore(testDB)
+	id := provisionAccount(t)
+	if bal, err := accounts.GrantHints(ctx, id, 4); err != nil || bal != 4 {
+		t.Fatalf("grant 4 = (%d, %v), want (4, nil)", bal, err)
+	}
+	if bal, err := accounts.GrantHints(ctx, id, 6); err != nil || bal != 10 {
+		t.Fatalf("grant 6 = (%d, %v), want (10, nil)", bal, err)
+	}
+	if _, err := accounts.GrantHints(ctx, id, 0); err == nil {
+		t.Error("grant 0 should be rejected (non-positive)")
+	}
+	if _, err := accounts.GrantHints(ctx, uuid.New(), 1); !errors.Is(err, account.ErrNotFound) {
+		t.Errorf("grant unknown account = %v, want ErrNotFound", err)
+	}
+}
+
 // consoleDo issues a request to h, optionally with an Origin header, and returns
 // the status and body. Form bodies are sent as application/x-www-form-urlencoded.
 func consoleDo(h http.Handler, method, target, body, origin string) (int, string) {