weekly challenges: admin-configurable slate + working skin rewards

Port the admin-editable weekly-challenge feature to the 2020.03 branch
and fix the skin-reward bug it had on December: rewards now actually
land in the player's inventory instead of only granting XP + tokens.

Server config: add WeeklyChallenges* columns to ServerSettings (Postgres
post-EnsureCreated patches + SQLite column patches), and port the
ServerSettingsService weekly methods/records. The reward record carries
the store item Slug — the reliable handle December lacked — so the grant
can resolve the real item.

ProgressionController: CurrentChallenge + updateProgress now read the
configured slate and reward instead of a hardcoded one, keeping the
2020.03 ChallengeMap/ChallengeGift wire shapes (verified against the
march dump: ChallengeGift TypeDefIndex 11455). The Gift now sends
AvatarItemType (Outfit when an AvatarItemDesc is set) so the watch's
gift-card render binds the avatar preview. On completing the week's
challenges the configured skin/consumable is granted via the new
StoreService.GrantItemFreeBySlugAsync (same inventory path as a purchase,
no charge), gated behind the once-only reward sentinel.

Admin: GET/POST settings/weekly-challenges + reward-options (avatar +
consumable only — 2020.03 StoreService has no equipment payload helper),
and the admin-ui Server settings page to edit the slate + reward. The
reward picker keys on item slug rather than December's fragile
descriptor-string match.

Docs: README no longer lists weekly challenges as December-only;
url-coverage notes the config-driven challenge endpoints + skin grant.

DorkNet.Server/Data/Entities/ServerSettingsEntity.cs

@@ -22,5 +22,24 @@ public class ServerSettingsEntity
     /// brand-new account requests are blocked.</summary>
     public bool SignupsDisabled { get; set; }
 
+    /// <summary>When true, the watch's weekly-challenge map reports
+    /// <c>CompletedRequired</c> — the player must finish every listed
+    /// challenge before the gift unlocks. Mirrors
+    /// <c>ChallengeMap.CompletedRequired</c> on the 2020.03 client.</summary>
+    public bool WeeklyChallengesCompletedRequired { get; set; } = true;
+
+    /// <summary>JSON-serialised <c>List&lt;WeeklyChallengeTemplate&gt;</c>
+    /// (see <c>ServerSettingsService</c>). Empty string falls back to
+    /// <c>ServerSettingsService.DefaultWeeklyChallenges()</c>. Admin-
+    /// editable from the SPA Settings page so the weekly slate can change
+    /// without a redeploy.</summary>
+    public string WeeklyChallengesJson { get; set; } = string.Empty;
+
+    /// <summary>JSON-serialised <c>WeeklyChallengeReward</c> — the gift
+    /// granted when the week's challenges complete (XP + tokens, plus an
+    /// optional store skin identified by <c>Slug</c>). Empty string falls
+    /// back to <c>ServerSettingsService.DefaultWeeklyReward()</c>.</summary>
+    public string WeeklyChallengeRewardJson { get; set; } = string.Empty;
+
     public DateTime UpdatedAt { get; set; } = DateTime.UtcNow;
 }

DorkNet.Server/Data/url-coverage.md

@@ -61,8 +61,8 @@ Note: counts are approximate because several client URLs (`api/avatar/v3/saved`,
 
 | Verb | URL | Status | Handler |
 |---|---|---|---|
-| GET  | `api/challenge/v2/getCurrent` | REAL | `ProgressionController.GetChallengeV2` — pulls active challenge for the player from the progression tables |
-| POST | `api/challenge/v2/updateProgress` | REAL | `ProgressionController.UpdateChallengeProgress` — writes back delta into progression rows |
+| GET  | `api/challenge/v2/getCurrent` | REAL | `ProgressionController.CurrentChallenge` — builds the weekly `ChallengeMap` from the admin-configured slate (`ServerSettingsService.GetWeeklyChallengesAsync`); per-player completion comes from progression rows |
+| POST | `api/challenge/v2/updateProgress` | REAL | `ProgressionController.UpdateChallengeProgress` — writes back the slot completion; on finishing the week's slate grants the configured reward (XP + tokens, plus the skin/consumable via `StoreService.GrantItemFreeBySlugAsync`) |
 
 ### `api/checklist/`