Adds a spend-coins-for-a-random-reward mini-game reachable from the
shop. Backend mirrors the store's existing atomic/idempotent purchase
pattern (SpinAsync in CreditStore.cs) with a server-authoritative,
weighted reward roll and a rolling per-user spin-rate guard; odds are
served from GET /api/credits/spin-config so the client never hardcodes
numbers that could drift from the real payout table. The mockup's
"Streak Protector" reward was swapped for a real Exam Simulation Token
since streaks aren't currently a persisted, protectable concept.
Also fixes two latent bugs surfaced while building this:
- credits_service.gd's operation-id builder referenced a nonexistent
AuthState.user_id (should be .username), throwing on every credit
action.
- _post() silently no-op'd with no signal when signed out, which
combined with a GDScript closure gotcha (lambdas capture outer
locals by value, so reassigning inside one never reached the
caller) meant a spin attempted while unauthenticated could hang
forever instead of surfacing an error.
hz