Onboarding Docs Visit

Grant the +50 docs_visit reward when a logged-in user loads /docs*.

Fired by an authenticated keepalive fetch from the docs templates (public/partials/_docs_scripts.html). This route has no rate limit of its own (session-authenticated requests bypass RateLimitMiddleware entirely, same as every other browser-session route), and the sessionStorage dedup on the client is only a soft, per-tab hint — a new tab, cleared storage, or incognito all cause a fresh beacon. So we pre-check status via get_progress() and short-circuit before ever calling grant_reward(): once granted, a repeat beacon costs one cheap SELECT instead of a doomed INSERT + rollback + diagnostic SELECT.