feat(gamification): Phase 1 — full kill-switch + textbook XP wrapping

Until now the 'gamification' feature flag did nothing: it had no row in
app_settings, the admin couldn't toggle it, awardXP/awardCoins ignored
it, and the CSS only hid three dashboard widgets — XP bars in textbooks
stayed visible regardless.

Phase 1 closes every hole.

Backend (source of truth):
  • migration 029 seeds feature_gamification_enabled=1
  • new isGamificationEnabled() helper in gamification/_shared.js with a
    30s cache + invalidateGamificationCache() for instant admin toggles
  • awardXP / awardCoins / updateStreak / unlockAchievement /
    checkAchievements all bail out when the flag is off
  • /api/gamification/* and /api/shop/* (user routes) return 404 when
    disabled; admin routes remain open so the switch itself is reachable
  • adminController.updateFeatures gains 'gamification' in the allow-list
    and invalidates the cache on flip

Frontend:
  • LS.isGamificationEnabled() (synchronous, populated by loadFeatures)
    so xp.js + applyCosmetics can bail without a round-trip
  • xp.js load/add/flush become no-ops when the flag is off
  • applyCosmetics skips the round-trip when off
  • CSS .no-gamification rule expanded to cover .hero-xp-badge, .po-xp,
    .xp-card, .xp-bar, #frames-section, and a universal [data-gamified]
    hook for future blocks

Textbooks (Variant 2 of the plan):
  • backend/scripts/wrap_textbook_xp.py — idempotent script that adds
    data-gamified to 167 XP tags across 63 textbook files (chapters +
    hubs, all subjects/grades). Single CSS rule now hides everything.

Verified end-to-end: with the flag off, awardXP/awardCoins write nothing;
flipping back restores normal behavior.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

js/xp.js

@@ -73,8 +73,19 @@
     try { localStorage.setItem(LS_KEY, String(xp)); } catch (e) {}
   }
 
+  /* ── Master kill-switch ──
+     If the gamification feature is globally disabled, every public
+     method becomes a no-op so textbooks don't display XP bars and
+     don't burn CPU/network on now-pointless syncs. The body class
+     `.no-gamification` (set by api.js) hides the DOM in parallel. */
+  function _gamOff() {
+    return window.LS && typeof window.LS.isGamificationEnabled === 'function'
+      && window.LS.isGamificationEnabled() === false;
+  }
+
   /* ── Загрузка с сервера + merge ── */
   async function load() {
+    if (_gamOff()) return null;
     try {
       const data = await _apiFetch(ENDPOINT_ME, { method: 'GET' });
       const serverXp = data.xp || 0;
@@ -87,6 +98,7 @@
       return _state;
     } catch (e) {
       if (e && e.status === 401) return null; // не авторизован — тихо пропускаем
+      if (e && e.status === 404) return null; // геймификация выключена — тихо
       return null; // сетевая ошибка — не ломаем учебник
     }
   }
@@ -124,6 +136,7 @@
   function flush() {
     if (_debounceTimer) { clearTimeout(_debounceTimer); _debounceTimer = null; }
     if (_pending <= 0) return;
+    if (_gamOff()) { _pending = 0; return; }   // drop pending — feature off
     const amount = _pending;
     _pending = 0;
     // source для flush — generic, реальный source записывается в каждом add()
@@ -152,6 +165,7 @@
   /* ── add: sync обновление localStorage + постановка в очередь ── */
   function add(amount, source) {
     if (!amount || amount <= 0) return;
+    if (_gamOff()) return;        // no-op when gamification globally off
     // Немедленно обновляем локальный XP
     const newXp = _localXp() + amount;
     _saveLocal(newXp);