web-next: herramientas de PD (transferir, comercio, códigos de promoción)

- /transfer-d-points: transferir PD a la cuenta dueña de un personaje
  (requiere token de seguridad; movimiento atómico con FOR UPDATE).
- /trade-points: comercio PD<->oro mediante códigos de 1 solo uso
  (contraseña + token + Turnstile; oro al creador por SOAP; expira 1h;
  lock de 5s tras canjear; rollback total si falla la entrega).
- /promo-code: canje de códigos por PD/PV (sensibles a mayúsculas/minúsculas,
  usos limitados, 1 canje por cuenta).
- /admin/promo: panel para crear / editar / activar / desactivar / borrar
  códigos de promoción.
- Tablas nuevas (sql/): home_tradecode, home_promocode, home_promoredemption.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web-next/app/api/admin/promo/[id]/route.ts

@@ -0,0 +1,31 @@
+import { getSession } from '@/lib/session'
+import { isAdmin } from '@/lib/admin'
+import { updatePromoCode, deletePromoCode } from '@/lib/admin-promo'
+
+export async function PATCH(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  const session = await getSession()
+  if (!(await isAdmin(session))) return Response.json({ success: false, error: 'forbidden' }, { status: 403 })
+  const { id } = await params
+  let b: Record<string, unknown> = {}
+  try {
+    b = await request.json()
+  } catch {
+    return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
+  }
+  const pd = Number(b.pd)
+  const pv = Number(b.pv)
+  const maxUses = Number(b.maxUses)
+  if (!Number.isInteger(pd) || pd < 0 || !Number.isInteger(pv) || pv < 0 || !Number.isInteger(maxUses) || maxUses < 1) {
+    return Response.json({ success: false, error: 'emptyError' })
+  }
+  await updatePromoCode(Number(id), { pd, pv, maxUses, active: Boolean(b.active) })
+  return Response.json({ success: true })
+}
+
+export async function DELETE(_request: Request, { params }: { params: Promise<{ id: string }> }) {
+  const session = await getSession()
+  if (!(await isAdmin(session))) return Response.json({ success: false, error: 'forbidden' }, { status: 403 })
+  const { id } = await params
+  await deletePromoCode(Number(id))
+  return Response.json({ success: true })
+}

web-next/app/api/admin/promo/route.ts

@@ -0,0 +1,28 @@
+import { getSession } from '@/lib/session'
+import { isAdmin } from '@/lib/admin'
+import { createPromoCode } from '@/lib/admin-promo'
+
+export async function POST(request: Request) {
+  const session = await getSession()
+  if (!(await isAdmin(session))) return Response.json({ success: false, error: 'forbidden' }, { status: 403 })
+  let b: Record<string, unknown> = {}
+  try {
+    b = await request.json()
+  } catch {
+    return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
+  }
+  const code = String(b.code ?? '').trim()
+  const pd = Number(b.pd)
+  const pv = Number(b.pv)
+  const maxUses = Number(b.maxUses)
+  const expiresAt = String(b.expiresAt ?? '')
+  if (!code || !Number.isInteger(pd) || pd < 0 || !Number.isInteger(pv) || pv < 0) {
+    return Response.json({ success: false, error: 'emptyError' })
+  }
+  if (!Number.isInteger(maxUses) || maxUses < 1) return Response.json({ success: false, error: 'emptyError' })
+  if (pd === 0 && pv === 0) return Response.json({ success: false, error: 'emptyError' })
+
+  const r = await createPromoCode(code, pd, pv, maxUses, expiresAt)
+  if (r.error) return Response.json({ success: false, error: r.error })
+  return Response.json({ success: true, id: r.id })
+}