feat(tutorial): add /tutorial/update — echo step + persist to viewer

POST /tutorial/update echoes tutorial_step back and saves it to
Viewer.MissionData.TutorialState. is_skip=1 is handled server-side
by honoring whatever tutorial_step value the client sends (client
already sends 100 when skipping). Adds TutorialUpdateRequest DTO,
TutorialUpdateResponse DTO, injects SVSimDbContext into
TutorialController, and adds GetViewerTutorialStateAsync helper to
SVSimTestFactory.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

SVSim.EmulatedEntrypoint/Controllers/TutorialController.cs

@@ -1,5 +1,8 @@
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using SVSim.Database;
 using SVSim.EmulatedEntrypoint.Models.Dtos.Requests.Tutorial;
+using SVSim.EmulatedEntrypoint.Models.Dtos.Responses.Tutorial;
 
 namespace SVSim.EmulatedEntrypoint.Controllers;
 
@@ -9,6 +12,13 @@ namespace SVSim.EmulatedEntrypoint.Controllers;
 /// </summary>
 public class TutorialController : SVSimController
 {
+    private readonly SVSimDbContext _db;
+
+    public TutorialController(SVSimDbContext db)
+    {
+        _db = db;
+    }
+
     [HttpPost("update_action")]
     public IActionResult UpdateAction([FromBody] TutorialUpdateActionRequest request)
     {
@@ -16,4 +26,19 @@ public class TutorialController : SVSimController
         // We still emit an empty object so the translation middleware has a `data` payload to wrap.
         return new JsonResult(new { });
     }
+
+    [HttpPost("update")]
+    public async Task<ActionResult<TutorialUpdateResponse>> Update([FromBody] TutorialUpdateRequest request)
+    {
+        if (!TryGetViewerId(out long viewerId)) return Unauthorized();
+
+        var viewer = await _db.Viewers
+            .Include(v => v.MissionData)
+            .FirstAsync(v => v.Id == viewerId);
+
+        viewer.MissionData.TutorialState = request.TutorialStep;
+        await _db.SaveChangesAsync();
+
+        return new TutorialUpdateResponse { TutorialStep = request.TutorialStep };
+    }
 }