fix(quest): close the defects the loyalty gating deep review found

[josephjang]

Stacked on #55. Base is feat/quest-loyalty-gating, so the diff here is only
the review fixes.

A /deep-review of #55 across ten angles. Forty findings fixed, four refuted
on re-verification, six returned as steering decisions and answered. The run
was killed twice by session limits and resumed from its checkpoint both times.

Interactive code guide:
docs/2026-09-quest-loyalty-gating-deep-review-guide.html
(8 chapters, 3 labs, comprehension gate). It pairs with the part 1 guide that
#55 adds, and which this PR also corrects.

The shape they share

Every defect is one rule written down in more than one place, with nothing
holding the copies together. A test over one copy passes. A test over the other
copy passes. Nothing tests that the two say the same thing, because in the
source they are two unrelated pieces of code that happen to encode one rule.

So most of these fixes are deletions.

The badge re-walked the engine's precedence

QuestStatus collapses causes on purpose: level, karma and loyalty all answer
LevelLocked, and three gates all answer Unavailable. The badge existed to
say which, and it did so by asking the same predicates again in an order copied
by hand.

Reorder the engine and every test stays green. The engine tests assert statuses,
which do not move; the badge tests chose settings where one gate was unmet.
Neither asked whether the badge names the gate the walk stopped at.

GetStatus now reports a QuestGate, and the badge is a switch over it. The
precedence exists once. A coupling test walks all ten gates and fails if the
badge is reverted to its own rule.

One bool for two edition rules

IsEditionRequirementMet folded "requires an edition you lack" and "bars an
edition you own" into one false. The badge then looked for a required edition
and printed its name, so a player barred by the excluded edition read EOD -
an edition they already owned. The walk now reports which rule failed.

The Traders table nothing loaded

TraderDbService reloads on DatabaseUpdated, which fires only after an actual
download, and the only other caller is a dialog a player may never open. So
every trader name read as the English nickname for a whole session, then
changed under the player when an hourly update landed. Korean and Japanese users
saw English throughout. The quest load now loads it, before the rows that
reference it.

No unit test found this, because every test that needed trader data loaded it
itself.

Dropping a row failed open

A requirement row with a blank nickname was dropped. The gate compares the
trader id and the nickname is a display value, so the row was usable - and
dropping it removed a gate the game still applies, making the quest available to
everybody. It is kept now, with a fallback for the name.

A published level above the app's ceiling is the same question with the opposite
answer: kept, because the gate is right and the input has fallen behind, and
warned about so the publish is visible in the log.

One ordering rule, in three places

FirstUnmetTraderLoyalty ranked as it scanned, the detail pane sorted its own
copy, and the loader's ORDER BY was a fourth weaker version. Three copies is
three chances for the badge to name one trader while the list under it puts
another first. SortIntoBadgeOrder runs once at load; every consumer is a plain
walk over that order.

The value type that handed out its store

TraderLoyaltyLevels.Entries returned its own SortedDictionary behind a
read-only interface. One cast could mutate it - and on the shared Empty
instance that corrupts every snapshot built from Defaults for the life of the
process. It returns a copy now, and the clamp moved into the type so With and
From are the only doors in.

Also

• The roster folded trader ids case-insensitively while the entered levels are
  keyed ordinally, so two ids differing only in case would have built one button
  whose level the gate could not read back.
• The Requirements section was three mechanisms (two TextBlocks and an
  ItemsControl, two bools and a three-term OR). One list over one view model
  now, and the level line's third copy of the met rule routes through
  QuestProgressService.
• The drawer's loyalty controls left MainWindow as a passive
  TraderLoyaltyPanel; the window keeps the subscriptions so the teardown guard
  still applies, and its two loyalty handlers share one coalescer, collapsing an
  eight-repaint fan-out to one.
• Documentation accuracy: stale gate and event counts in four source files, the
  part 1 guide's "eight events", and two spec claims the shipped code
  contradicts.

Tests

1563 before, 1653 after (+90): 1606 non-E2E and 47 E2E.

New suites: ProfileDrawerFitTests, MainWindowTeardownTests,
QuestRequirementLinesTests, TraderLoyaltyPanelTests, plus shared
LoyaltyFixtures.

Tests proven inert and tightened: the badge suite no longer asserts a precedence
of its own (that would be a second copy of the rule) and instead runs the walk
and asserts the badge against the gate it reports; the loader suite gained the
keep-or-drop cases in both directions.

Verification

dotnet build TarkovHelper.sln                      # Debug and Release, 0 warnings, 0 errors
dotnet test --no-build --filter "Category!=E2E"    # 1606 passed
dotnet test --no-build --filter "Category=E2E"     # 47 passed, 2 skipped, 0 failed
node .agents/skills/code-guide/scripts/check-guide.mjs docs/2026-09-...-deep-review-guide.html
node .agents/skills/code-guide/scripts/check-ste.mjs   docs/2026-09-...-deep-review-guide.html

Both guides re-verified after the review edited them: checkers pass, and their
node drivers assert 2331 and 1434 outcomes against the shipped C#.

Residuals

Two decisions traded a mechanical guarantee for a process one. Both are
recorded in the spec with what they leave open, and both are worth a second
opinion at merge:

• The loyalty ceiling stays an app constant. A publish asking for level 5
  reaches installed builds without an app release, and those builds show the
  quest permanently locked behind a stepper that stops at 4. A content test
  fails on the publish PR, so the guarantee is that CI runs and somebody reads
  it. The loader now warns at load as a second signal.
• TableExistsAsync has six copies (and ColumnExistsAsync three), tracked
  by refactor(db): collapse the duplicated TableExistsAsync and ColumnExistsAsync helpers #56 rather than refactored, cross-referenced from a comment at the
  duplication site. The seventh copy gets written by whoever adds the next
  *DbService.

Carried forward from #55: the seasonal quests stay ungated until upstream
publishes their loyalty rows, and the Collector page is phase 5.

Read closely: the TraderLoyaltyPanel extraction is a plain class rather
than a .xaml pair, because ProfileDrawerFitTests parses the drawer as loose
XAML and a UserControl cannot resolve there. That was the fixer's judgement
call and it is flagged as such.

Merge order

#55 first. GitHub retargets this to main when
feat/quest-loyalty-gating is deleted; confirm the base reads main before
merging.