Server persistence: EF Core profiles + coin ledger + authoritative rewards

- EF Core (SQLite dev / Postgres prod via config); ProfileRow JSON blob +
  LedgerRow audit; EnsureCreated at startup
- C# Gamification port (ranks/elo/coins/xp/achievements/titles) → server
  computes match rewards; ProfileService (get/update/plan/buyCoins/applyMatch)
- JWT endpoints: profile GET/PUT, plan, coins packs/buy, match/result;
  auth upserts the profile
- Tested end-to-end (buy + ranked win+kot persisted & server-computed)
- Client still mock-backed for now (wiring is the next step)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/README.md

@@ -60,9 +60,34 @@ existing `OnlineService` interface (`@microsoft/signalr`), then switch
 `getService()` in `../src/lib/online/service.ts` from the mock to it. The hub's
 `GameStateDto` is shaped to map directly onto the client `GameState`.
 
+## Persistence (EF Core)
+
+`AppDbContext` stores each profile as a JSON blob (`ProfileRow`) + a coin
+`LedgerRow` audit trail. Provider is config-driven:
+
+```jsonc
+// appsettings.json
+"Database": { "Provider": "sqlite" },            // or "postgres"
+"ConnectionStrings": { "Default": "Data Source=hokm.db" }
+// Postgres (Supabase): Provider="postgres",
+//   Default="Host=...;Database=...;Username=...;Password=...;SSL Mode=Require"
+```
+
+Schema is created at startup via `EnsureCreated()` (swap to EF migrations for prod).
+
+**Server-authoritative endpoints (JWT):**
+- `GET  /api/profile` · `PUT /api/profile` (displayName/avatar/title/cardFront/cardBack)
+- `POST /api/profile/plan` (upgrade to pro)
+- `GET  /api/coins/packs` · `POST /api/coins/buy` `{ packId }` (credits + ledger; real Zarinpal/IDPay TODO)
+- `POST /api/match/result` `{ MatchSummary }` → computes rewards via `Profiles/Gamification.cs`
+  (C# port of `src/lib/online/gamification.ts`), updates profile + ledger, returns `RewardResult`
+
+Auth (`/api/auth/...`) upserts the profile on first sign-in.
+
 ## TODO
 
-- EF Core + Postgres persistence (profiles, coins, rank, cosmetics, match history)
+- Wire the Next client (`SignalrService`) to these endpoints for profile/coins/match
+  (currently still mock-backed to avoid a half-migrated economy)
+- EF migrations; Postgres (Supabase) connection for prod
 - JWT issued by the V2 Identity Service; phone OTP via Kavenegar/SMS.ir
-- Private rooms + friend invites over the hub (engine/room already support 4 seats)
-- Server-side reward calculation (currently client/profile-side)
+- Private rooms + friend invites over the hub; server-side ranked entry deduction at match start