Phase 15: add GET /packs/store endpoint

Returns all pack definitions with id, name, description, cost_coins, and
total_cards so the dashboard can render a purchasable pack store without
needing to know the definitions at compile time.

Two new tests: store listing shape and buy-then-open round-trip.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/integration_test.rs

@@ -1409,3 +1409,43 @@ async fn test_rivals_reward_increments_week_counter() {
     assert_eq!(s, StatusCode::OK, "{json}");
     assert_eq!(json["week_number"], 2, "second claim should be week 2");
 }
+
+// ── Phase 15: Pack Store ──────────────────────────────────────────────────────
+
+#[tokio::test]
+async fn test_pack_store_lists_definitions() {
+    let app = build_test_app().await;
+    auth(&app, "StorePlayer").await;
+
+    let (status, json) = json_get(&app, "/packs/store").await;
+    assert_eq!(status, StatusCode::OK, "{json}");
+    let packs = json["packs"].as_array().expect("packs array");
+    assert!(!packs.is_empty(), "store should have at least one pack definition");
+    let first = &packs[0];
+    assert!(first["id"].is_string(), "id missing");
+    assert!(first["name"].is_string(), "name missing");
+    assert!(first["cost_coins"].is_number(), "cost_coins missing");
+    assert!(first["total_cards"].is_number(), "total_cards missing");
+}
+
+#[tokio::test]
+async fn test_pack_store_buy_then_opens() {
+    let app = build_test_app().await;
+    auth(&app, "StoreBuyer").await;
+
+    // Get cheapest pack from store
+    let (_, store) = json_get(&app, "/packs/store").await;
+    let packs = store["packs"].as_array().unwrap();
+    let cheapest = packs.iter().min_by_key(|p| p["cost_coins"].as_i64().unwrap_or(i64::MAX)).unwrap();
+    let def_id = cheapest["id"].as_str().unwrap();
+
+    // Buy it
+    let (status, json) = json_post(&app, "/packs/buy", serde_json::json!({ "pack_definition_id": def_id })).await;
+    assert_eq!(status, StatusCode::OK, "buy failed: {json}");
+    let pack_id = json["pack"]["id"].as_str().expect("pack id").to_string();
+
+    // Open it
+    let (status, json) = json_post(&app, &format!("/packs/open/{pack_id}"), serde_json::json!({})).await;
+    assert_eq!(status, StatusCode::OK, "open failed: {json}");
+    assert!(json["cards"].as_array().map(|a| !a.is_empty()).unwrap_or(false), "opened pack should contain cards");
+}