feat(payments): chip wallet, store-compliance gate and benefit application

Stand up the internal chip/benefit mechanic behind the narrow payments interface:
context-aware balances and benefits, an atomic chip spend, admin grants as
zero-price value sales, the one-directional store-compliance gate (VK/TG same-
origin only, web draws direct→vk→tg, VK-iOS frozen, untrusted fail-closed), and
per-origin hint and no-ads application with term stacking. Reads are served from
an in-process, account-keyed write-through cache (mirroring the suspension gate),
so hot paths issue no query to the payments schema.

Flip the online-game hint wallet and the ad-banner suppression from the deprecated
accounts.hint_balance / paid_account columns to the payments benefit (a hint
balance no longer suppresses the banner — only a no-ads benefit does), and fold
chip segments and benefits by origin on account merge, inside the merge tx. Add
the GET/POST /api/v1/user/wallet edge chain (REST → Connect → FlatBuffers) plus
its codec unit test; no wallet UI yet.

Bring the frozen owner decisions log into the repo at
docs/PAYMENTS_DECISIONS_ru.md (it was untracked under .vscode) and reference it
from PLAN.md; record the read-cache design and the present-sources interface in
PLAN.md and docs/PAYMENTS.md (+ RU mirror).

gateway/internal/transcode/encode.go

@@ -79,6 +79,34 @@ func encodeConfirmLinkResult(r backendclient.ConfirmLinkResp) []byte {
 
 // encodeProfile builds a Profile payload, including the advertising-banner block
 // when the backend marked the viewer eligible.
+// encodeWallet builds the Wallet payload: the visible chip segments and the context-applicable
+// benefits. Each WalletSegment table (and its source string) is built before the segments vector
+// is opened, per FlatBuffers' rule against a nested table while another is under construction.
+func encodeWallet(w backendclient.WalletResp) []byte {
+	b := flatbuffers.NewBuilder(128)
+	segs := make([]flatbuffers.UOffsetT, len(w.Segments))
+	for i, seg := range w.Segments {
+		src := b.CreateString(seg.Source)
+		fb.WalletSegmentStart(b)
+		fb.WalletSegmentAddSource(b, src)
+		fb.WalletSegmentAddChips(b, int32(seg.Chips))
+		fb.WalletSegmentAddSpendable(b, seg.Spendable)
+		segs[i] = fb.WalletSegmentEnd(b)
+	}
+	fb.WalletStartSegmentsVector(b, len(segs))
+	for i := len(segs) - 1; i >= 0; i-- {
+		b.PrependUOffsetT(segs[i])
+	}
+	segVec := b.EndVector(len(segs))
+	fb.WalletStart(b)
+	fb.WalletAddSegments(b, segVec)
+	fb.WalletAddAdsForever(b, w.AdsForever)
+	fb.WalletAddAdsPaidUntilMs(b, w.AdsPaidUntil)
+	fb.WalletAddHints(b, int32(w.Hints))
+	b.Finish(fb.WalletEnd(b))
+	return b.FinishedBytes()
+}
+
 func encodeProfile(p backendclient.ProfileResp) []byte {
 	b := flatbuffers.NewBuilder(192)
 	uid := b.CreateString(p.UserID)