controller(card): POST /card/protect

SVSim.EmulatedEntrypoint/Controllers/CardController.cs

@@ -132,6 +132,24 @@ public class CardController : SVSimController
         _ => "malformed_request",
     };
 
+    [HttpPost("protect")]
+    public async Task<ActionResult<CardProtectResponse>> Protect(CardProtectRequest request)
+    {
+        if (!TryGetViewerId(out long viewerId)) return Unauthorized();
+
+        var outcome = await _inventory.SetProtected(viewerId, request.CardId, request.IsProtected);
+        if (!outcome.IsSuccess)
+        {
+            return outcome.Error switch
+            {
+                ProtectError.UnknownCard => BadRequest(new { error = "unknown_card" }),
+                _                        => BadRequest(new { error = "malformed_request" }),
+            };
+        }
+
+        return new CardProtectResponse();
+    }
+
     private static string ErrorKey(DestructError error) => error switch
     {
         DestructError.UnknownCard       => "unknown_card",