[neeerp]

Row 205, NX source 4 (the last one): the world server can listen for a vote site. When a site reports a vote, the account gets NX Credit, once per cooldown. The hook is off unless configured.

• Config: RUSTMS_VOTE_HOOK_ADDR plus RUSTMS_VOTE_HOOK_SECRET turn it on. RUSTMS_VOTE_NX (default 1000) and RUSTMS_VOTE_COOLDOWN_HOURS (default 12) set the amount and the cooldown.
• Requests (runtime::vote_hook): a site sends GET or POST /vote with account (the login name) and secret. They can come in the query, a form body, or an X-Vote-Secret header. The head is capped at 8 KB, the body at 4 KB, and a caller has 5 s to send its request. The secret is compared in constant time.
• Answers are plain text: 200 counted, 429 too soon, 404 no such account, 403 wrong secret, 400 bad request.
• Storage: a new votes table, written by db::vote::record. One transaction locks the account row, checks the last vote against the cooldown, inserts the vote and adds the credit. db::cash_shop::grant now shares its credit logic with it (add_cash).
• Harness: the world's hook is on world port + 3 (HARNESS_VOTE_PORT). The new tests/vote_hook.rs covers a wrong secret (403), an unknown account (404), a form POST with the header secret (200), a second vote (429), and the credit in the Cash Shop.

Verified:

• cargo test -p runtime vote_hook: 3 parser tests pass.
• Harness: vote_hook, earned_nx, gm_commands and login_to_world pass.