feat(ads): rewarded video (VK) — client-attested credit + daily/hourly caps

The first ads slice: a voluntary rewarded video credits chips. VK Mini App ads
(VKWebAppShowNativeAds) expose only a client-side watch result — no
server-to-server verify — so the credit is client-attested, guarded by a server
daily + hourly cap (config reward_daily_cap / reward_hourly_cap, default 50 / 10).
The caps are both anti-abuse (bounding a forger who skips the ad and calls the
endpoint directly) and an economic conversion lever (limiting free chips so a
player who wants more buys). D29 amended to VK's reality.

Backend: CreditReward (VK-only, order-less, idempotent on a client nonce, floored
by the caps; payout from config rewarded_payout_chips, default 0 = off) + the
wallet.reward edge op returning the updated wallet (reward_chips gates the
"watch for chips" CTA). Additive migration (two config columns).

Client: the ads-network abstraction (lib/ads.ts, VK impl) + the VK bridge
(vkRewardedReady / vkShowRewarded) + the Wallet CTA + i18n. A contour test stub
(VITE_ADS_STUB -> a toast instead of a real ad; prod always real) and a temporary
diagnostic that logs the raw VK data, so we confirm on the contour exactly what
VK returns (harden to signature-verify if it carries one).

Tests: backend integration (credit, nonce idempotency, hourly cap, disabled,
non-VK refusal) + codec unit (reward wire). Docs: PAYMENTS(+ru) §10, D29 amend,
PLAN E6. Bundle: shared budget 30->31 (reward i18n strings).

ui/src/lib/vk.ts

@@ -197,6 +197,35 @@ export async function vkShowOrderBox(item: string): Promise<boolean> {
   }
 }
 
+/**
+ * vkRewardedReady reports whether a rewarded ad is preloaded and ready to show
+ * (VKWebAppCheckNativeAds, required before a rewarded view). A false — or an unavailable method —
+ * hides the "watch for chips" button, since tapping it would show nothing.
+ */
+export async function vkRewardedReady(): Promise<boolean> {
+  try {
+    const data = await (await bridge()).send('VKWebAppCheckNativeAds', { ad_format: 'reward' });
+    return !!(data as { result?: boolean }).result;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * vkShowRewarded shows a rewarded ad (VKWebAppShowNativeAds) and reports whether it was watched
+ * (data.result) plus the full raw provider result as JSON — forwarded to the backend for the
+ * temporary contour diagnostic (to confirm exactly what VK returns). A rejected call reports
+ * not-watched with the error captured.
+ */
+export async function vkShowRewarded(): Promise<{ watched: boolean; data: string }> {
+  try {
+    const data = await (await bridge()).send('VKWebAppShowNativeAds', { ad_format: 'reward' });
+    return { watched: !!(data as { result?: boolean }).result, data: JSON.stringify(data) };
+  } catch (e) {
+    return { watched: false, data: JSON.stringify({ error: String(e) }) };
+  }
+}
+
 /**
  * vkDownloadFile downloads url as filename through the VK client (VKWebAppDownloadFile) —
  * the mobile in-app file delivery, where the webview ignores <a download>. Resolves false