feat(admin): admin grant — raw benefits and by-product reward bundles

The /_gm user card gains a Grant panel: grant raw benefit atoms (hints /
no-ads days / forever) or a defined value product (a reward bundle, including
an archived one), origin-picked. Both write an admin_grant ledger row via
payments.Grant / GrantProduct; the by-product grant records the source
product_id + snapshot. Both refuse a chips atom (never grant currency) or a
tournament atom (no credit target yet); chips/tournament products are also
kept out of the by-product picker.

Tests: the console grant end to end (raw, by-product, refuse a chips pack,
CSRF-guarded).

backend/internal/server/handlers_admin_console.go

@@ -58,6 +58,8 @@ func (s *Server) registerConsole(router *gin.Engine) {
 	gm.POST("/users/:id/grant-role", s.consoleGrantRole)
 	gm.POST("/users/:id/revoke-role", s.consoleRevokeRole)
 	gm.POST("/users/:id/remove-email", s.consoleRemoveEmail)
+	gm.POST("/users/:id/grant", s.consoleGrant)
+	gm.POST("/users/:id/grant-product", s.consoleGrantProduct)
 	gm.POST("/users/:id/delete", s.consoleDeleteUser)
 	gm.GET("/reasons", s.consoleReasons)
 	gm.POST("/reasons", s.consoleCreateReason)
@@ -451,6 +453,7 @@ func (s *Server) consoleUserDetail(c *gin.Context) {
 		} else {
 			s.log.Warn("console: account statement failed", zap.String("account", id.String()), zap.Error(err))
 		}
+		view.Grant = s.grantForm(ctx)
 	}
 	s.renderConsole(c, "user_detail", "users", acc.DisplayName, view)
 }