fix(gift): receive response is idempotent and echoes persisted state

Three coupled correctness fixes to /tutorial/gift_receive's response:

- received_ids / total_receive_count_list / reward_list are now built
  from `toClaim` (the gifts THIS call granted), not from `requestedIds`.
  Echoing the client's request meant idempotent re-claims re-fired the
  "+N received" popup and direct-assigned the same post-state totals
  again, breaking the documented idempotency contract.
- is_unreceived_present is now `unclaimedPresents.Count > 0`. The
  hardcoded false hid the inbox badge after partial claims even when
  present_list still carried unclaimed gifts.
- tutorial_step echoes the persisted (max-preserved) state instead of
  a hardcoded 41. A replay against a state>=41 viewer used to surface
  41 on the wire and regress the client's tutorial state machine.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

SVSim.UnitTests/Controllers/GiftControllerTests.cs

@@ -112,13 +112,73 @@ public class GiftControllerTests
 
         // Response carries the new step inline.
         Assert.That(root.GetProperty("tutorial_step").GetInt32(), Is.EqualTo(41));
-        Assert.That(root.GetProperty("is_unreceived_present").GetBoolean(), Is.False);
+        // Only 1 of 5 gifts claimed → 4 remain unclaimed → badge state must be "still has presents".
+        Assert.That(root.GetProperty("is_unreceived_present").GetBoolean(), Is.True,
+            "Partial claim leaves 4 gifts unclaimed in present_list — is_unreceived_present " +
+            "must reflect that so the client's inbox badge keeps surfacing.");
         Assert.That(root.GetProperty("reward_list").GetArrayLength(), Is.EqualTo(1));
+        Assert.That(root.GetProperty("present_list").GetArrayLength(), Is.EqualTo(4));
 
         // Side effect: viewer state advanced to 41.
         Assert.That(await factory.GetViewerTutorialStateAsync(viewerId), Is.EqualTo(41));
     }
 
+    [Test]
+    public async Task GiftReceive_returns_empty_received_ids_on_idempotent_replay()
+    {
+        using var factory = new SVSimTestFactory();
+        await factory.SeedGlobalsAsync();
+        long viewerId = await factory.SeedViewerAsync(tutorialState: 31);
+        using var client = factory.CreateAuthenticatedClient(viewerId);
+
+        var json = $$"""{"present_id_array":["71478626","71478627"],"state":1,{{BaseAuthBlock}}}""";
+
+        // First call grants both gifts.
+        await client.PostAsync("/tutorial/gift_receive",
+            new StringContent(json, Encoding.UTF8, "application/json"));
+
+        // Second call (replay) must return empty received_ids / total_receive_count_list /
+        // reward_list — these lists describe what THIS call granted, not what the client
+        // asked for. Echoing requested ids would re-fire the client's "received N gifts"
+        // popup and direct-assign the same post-state totals again.
+        var second = await client.PostAsync("/tutorial/gift_receive",
+            new StringContent(json, Encoding.UTF8, "application/json"));
+        Assert.That(second.StatusCode, Is.EqualTo(HttpStatusCode.OK));
+        using var doc = JsonDocument.Parse(await second.Content.ReadAsStringAsync());
+        var root = doc.RootElement;
+
+        Assert.That(root.GetProperty("received_ids").GetArrayLength(), Is.EqualTo(0),
+            "Idempotent re-claim grants nothing → received_ids empty.");
+        Assert.That(root.GetProperty("total_receive_count_list").GetArrayLength(), Is.EqualTo(0));
+        Assert.That(root.GetProperty("reward_list").GetArrayLength(), Is.EqualTo(0));
+
+        // present_history_list still includes the originally-claimed gifts.
+        Assert.That(root.GetProperty("present_history_list").GetArrayLength(), Is.EqualTo(2));
+    }
+
+    [Test]
+    public async Task GiftReceive_echoes_persisted_tutorial_step_not_hardcoded_41()
+    {
+        using var factory = new SVSimTestFactory();
+        await factory.SeedGlobalsAsync();
+        // Viewer is past the tutorial entirely (state=100). The gift_receive endpoint is
+        // still reachable via /tutorial/gift_receive — a stale client retry, for instance.
+        // The persistence side max-preserves (keeps state at 100); the response must echo
+        // 100, not the hardcoded 41 the endpoint used to emit, or the client's tutorial
+        // state machine regresses on a no-op retry.
+        long viewerId = await factory.SeedViewerAsync(tutorialState: 100);
+        using var client = factory.CreateAuthenticatedClient(viewerId);
+
+        var json = $$"""{"present_id_array":["71478626"],"state":1,{{BaseAuthBlock}}}""";
+        var response = await client.PostAsync("/tutorial/gift_receive",
+            new StringContent(json, Encoding.UTF8, "application/json"));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.OK));
+        using var doc = JsonDocument.Parse(await response.Content.ReadAsStringAsync());
+        Assert.That(doc.RootElement.GetProperty("tutorial_step").GetInt32(), Is.EqualTo(100));
+        Assert.That(await factory.GetViewerTutorialStateAsync(viewerId), Is.EqualTo(100));
+    }
+
     [Test]
     public async Task GiftReceive_with_pre_owned_item_increments_existing_row()
     {