fix(payments): VK-iOS freeze is purchase-only; remove the rewarded diagnostic

Testing the rewarded slice surfaced a contradiction: rewarded ads let a VK-iOS
user earn vk chips, but the blanket VK-iOS "spend freeze" then blocked spending
them (the wallet showed "5 (view-only)"). Apple's ToS forbids only BUYING in-app
values on VK-iOS (money -> chips), not spending or earning them — so the freeze is
corrected to purchase-only: vkFrozen() now gates only CreateOrder (the money-in
step), not spendableSources (spending). VK-wallet chips — earned via rewarded ads
or bought on the same account elsewhere (VK Android) — now spend on VK-iOS too.
(Owner's ToS finding.)

Also: the temporary contour diagnostic confirmed VK returns only {result:true} for
a rewarded view (no token/signature) — client-attested is final, no hardening
possible — so the diagnostic (the log and the diag wire field) is removed.

Docs: PAYMENTS(+ru) VK-iOS freeze + D17 amend + PLAN E6. Tests updated (gate /
wallet VK-iOS now spendable).

backend/internal/server/handlers_wallet.go

@@ -175,12 +175,10 @@ func (s *Server) handleWalletBuy(c *gin.Context) {
 	c.JSON(http.StatusOK, walletDTOFrom(view))
 }
 
-// walletRewardRequest is the POST body of a rewarded-video credit: a client nonce (the idempotency
-// key for a single watched view — a retry credits once) and Diag, the raw VK ad result forwarded for
-// a temporary diagnostic log while we confirm exactly what VK returns on the contour.
+// walletRewardRequest is the POST body of a rewarded-video credit: a client nonce, the idempotency
+// key for a single watched view (a retry credits once).
 type walletRewardRequest struct {
 	Nonce string `json:"nonce"`
-	Diag  string `json:"diag"`
 }
 
 // handleWalletReward credits a rewarded-video view's chips to the VK segment, client-attested and
@@ -203,15 +201,6 @@ func (s *Server) handleWalletReward(c *gin.Context) {
 		s.abortErr(c, err)
 		return
 	}
-	// Temporary diagnostic: log the raw VK ad result (bounded — untrusted client input) to learn its
-	// exact shape on the contour; if it carries a verifiable token we harden past client-attested.
-	if req.Diag != "" {
-		diag := req.Diag
-		if len(diag) > 2000 {
-			diag = diag[:2000]
-		}
-		s.log.Info("rewarded ad diagnostic", zap.String("account", uid.String()), zap.String("vk_data", diag))
-	}
 	outcome, err := s.payments.CreditReward(ctx, uid, cxt, present, req.Nonce)
 	if err != nil {
 		s.abortErr(c, err)