fix: second pass over the 2023-client wire defects, plus a coverage harness

Fourteen agents worked one server file each over the audit's open findings,
re-verifying every claim against the client binary before changing anything.
Route+verb coverage against the recovered client inventory is now 474/522
(90.8%), up from 86.2% when the harness was first wired up.

Adds ClientRouteCoverageTests, which turns "are we compliant?" into a number
instead of an opinion. It reads data/client-routes-2023.tsv — every request the
2023-03-21 client can issue, recovered from the binary — and asserts each one
has a handler under the verb the client actually uses, separating "no handler"
from "handler exists, wrong verb" since those have different fixes. Remaining
gaps live in KnownGaps, which is expected to shrink and never grow.

Also fixes a real blind spot in EndpointContractDiscovery: it only collected
HttpMethodAttribute, so an action carrying a bare [Route] with no verb attribute
was invisible to it. The CDN's unity_assets handler is exactly that shape, which
had been showing up as a phantom gap.

Notable findings from this pass:

- The club permissions envelope key is literally "Type", not "MembershipType"
  as the audit's suggested fix guessed. Read off the generated reader, then
  cross-checked against the 2020 decompile — the int bitmask we were emitting
  was wrong for BOTH client generations, not just 2023.
- Room-consumable purchase responses carry OperationResult as an OBJECT
  { Status, InventoryItem }; the scalar operation enum belongs in
  BalanceUpdateResult. The base type OKHNOPLBOFP holds a single BGHBAILNNJJ,
  which exposes exactly those two properties. A test asserting the old scalar
  shape was corrected rather than the code.
- buyProgressionEventXpBoost blind-inserted an ObjectiveProgress row whose
  (PlayerId, Key) is unique, so a second purchase of the same boost threw
  "UNIQUE constraint failed" and 500'd AFTER taking the player's currency.
  Now an upsert.

Agents were forbidden from faking fixes they could not complete in their own
file, and several correctly refused: club role permissions, club additional
image slots, announcement meta, MinLevel/ClubChatEnabled, currency purchase
offer ordering, and room-key image/currency columns all need new entities or
columns. Those are deliberately left for a single coherent schema change rather
than stubbed out here.

DorkNet.Server/Controllers/API/RoomCurrencies/RoomCurrenciesController.cs

@@ -311,7 +311,11 @@ public class RoomCurrenciesController(DorkNetDbContext db, LevelService level) :
         if (offerIds.Count > 0) query = query.Where(x => offerIds.Contains(x.o.PublicId));
         if (currencyIds.Count > 0) query = query.Where(x => currencyIds.Contains(x.c.PublicId));
 
-        var rows = await query.Take(200).ToListAsync();
+        // The client reads an "Order" key (AALDCAANEMM.txt:550) but there is no
+        // column to persist it into yet, so ToOfferWire reports 0 for every pack
+        // and the client keeps the order it received them in — order by insertion
+        // id so that fallback is at least stable across fetches.
+        var rows = await query.OrderBy(x => x.o.Id).Take(200).ToListAsync();
 
         // The response is GROUPED: List<{CurrencyId, PurchaseOffers}> (formatter
         // LKBGCOELLIN.txt:215-258 reads only those two keys). A flat offer list
@@ -453,13 +457,13 @@ public class RoomCurrenciesController(DorkNetDbContext db, LevelService level) :
     {
         var fields = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
         foreach (var pair in Request.Query)
-            fields[pair.Key] = pair.Value.FirstOrDefault() ?? string.Empty;
+            fields[pair.Key] = Flatten(pair.Value);
 
         if (Request.HasFormContentType)
         {
             var form = await Request.ReadFormAsync();
             foreach (var pair in form)
-                fields[pair.Key] = pair.Value.FirstOrDefault() ?? string.Empty;
+                fields[pair.Key] = Flatten(pair.Value);
             return fields;
         }
 
@@ -489,6 +493,21 @@ public class RoomCurrenciesController(DorkNetDbContext db, LevelService level) :
         return fields;
     }
 
+    /// <summary>Collapses a multi-valued query/form key into the comma-joined form
+    /// <see cref="ReadGuidList"/>/<see cref="ReadLongList"/> already split on.
+    ///
+    /// getPurchaseOffersBatch pushes its currency-id list through the generic batch
+    /// param helper (<c>0x181F2DCD0</c> with <c>"ids"</c>,
+    /// MIHKAJFMIPE_NestedType_OBLJADOFIED.txt:228-230), which is the same helper
+    /// every other RecNet batch route uses to REPEAT the key once per id
+    /// (<c>?ids=a&amp;ids=b</c>). Taking only <c>FirstOrDefault()</c> silently
+    /// dropped every id after the first, so a multi-currency room fetched packs for
+    /// exactly one of its currencies.</summary>
+    private static string Flatten(Microsoft.Extensions.Primitives.StringValues values) =>
+        values.Count <= 1
+            ? values.FirstOrDefault() ?? string.Empty
+            : string.Join(",", values.Where(v => !string.IsNullOrWhiteSpace(v)));
+
     private async Task<string?> ReadJsonBodyAsync()
     {
         if ((Request.ContentLength ?? 0) <= 0) return null;