fix(payments): VK-iOS freeze is purchase-only; remove the rewarded diagnostic

Testing the rewarded slice surfaced a contradiction: rewarded ads let a VK-iOS
user earn vk chips, but the blanket VK-iOS "spend freeze" then blocked spending
them (the wallet showed "5 (view-only)"). Apple's ToS forbids only BUYING in-app
values on VK-iOS (money -> chips), not spending or earning them — so the freeze is
corrected to purchase-only: vkFrozen() now gates only CreateOrder (the money-in
step), not spendableSources (spending). VK-wallet chips — earned via rewarded ads
or bought on the same account elsewhere (VK Android) — now spend on VK-iOS too.
(Owner's ToS finding.)

Also: the temporary contour diagnostic confirmed VK returns only {result:true} for
a rewarded view (no token/signature) — client-attested is final, no hardening
possible — so the diagnostic (the log and the diag wire field) is removed.

Docs: PAYMENTS(+ru) VK-iOS freeze + D17 amend + PLAN E6. Tests updated (gate /
wallet VK-iOS now spendable).

ui/src/lib/codec.ts

@@ -403,14 +403,12 @@ export function decodeWallet(buf: Uint8Array): Wallet {
 }
 
 // encodeWalletReward wraps a watched rewarded video for crediting (POST /user/wallet/reward): the
-// per-view idempotency nonce and the raw VK ad result forwarded for the contour diagnostic.
-export function encodeWalletReward(nonce: string, diag: string): Uint8Array {
+// per-view idempotency nonce.
+export function encodeWalletReward(nonce: string): Uint8Array {
   const b = new Builder(64);
   const n = b.createString(nonce);
-  const d = b.createString(diag);
   fb.WalletRewardRequest.startWalletRewardRequest(b);
   fb.WalletRewardRequest.addNonce(b, n);
-  fb.WalletRewardRequest.addDiag(b, d);
   return finish(b, fb.WalletRewardRequest.endWalletRewardRequest(b));
 }