controller(card): POST /card/protect

SVSim.EmulatedEntrypoint/Controllers/CardController.cs

@@ -132,6 +132,24 @@ public class CardController : SVSimController
         _ => "malformed_request",
     };
 
+    [HttpPost("protect")]
+    public async Task<ActionResult<CardProtectResponse>> Protect(CardProtectRequest request)
+    {
+        if (!TryGetViewerId(out long viewerId)) return Unauthorized();
+
+        var outcome = await _inventory.SetProtected(viewerId, request.CardId, request.IsProtected);
+        if (!outcome.IsSuccess)
+        {
+            return outcome.Error switch
+            {
+                ProtectError.UnknownCard => BadRequest(new { error = "unknown_card" }),
+                _                        => BadRequest(new { error = "malformed_request" }),
+            };
+        }
+
+        return new CardProtectResponse();
+    }
+
     private static string ErrorKey(DestructError error) => error switch
     {
         DestructError.UnknownCard       => "unknown_card",

SVSim.EmulatedEntrypoint/Models/Dtos/Requests/Card/CardProtectRequest.cs

@@ -0,0 +1,21 @@
+using MessagePack;
+using System.Text.Json.Serialization;
+
+namespace SVSim.EmulatedEntrypoint.Models.Dtos.Requests.Card;
+
+/// <summary>
+/// POST /card/protect. Toggles the protected-card flag for a single card. The client (see
+/// Wizard/CardProtectTask.cs) sends is_protected as a real boolean — the 0|1 int inconsistency
+/// noted in the spec lives on the /load/index response side and is out of scope here.
+/// </summary>
+[MessagePackObject]
+public class CardProtectRequest : BaseRequest
+{
+    [JsonPropertyName("card_id")]
+    [Key("card_id")]
+    public long CardId { get; set; }
+
+    [JsonPropertyName("is_protected")]
+    [Key("is_protected")]
+    public bool IsProtected { get; set; }
+}

SVSim.EmulatedEntrypoint/Models/Dtos/Responses/Card/CardProtectResponse.cs

@@ -0,0 +1,12 @@
+using MessagePack;
+
+namespace SVSim.EmulatedEntrypoint.Models.Dtos.Responses.Card;
+
+/// <summary>
+/// /card/protect response data — empty. The client just needs result_code=1 in the envelope's
+/// data_headers; it mutates its own FavoriteCardList from its request-side knowledge.
+/// </summary>
+[MessagePackObject]
+public class CardProtectResponse
+{
+}