fix: contributeToEvent computed XP but never awarded it — call award_xp_secure (#220)

[vedant7007]

Summary

`contributeToEvent` computed `totalToAward = totalXpAwarded + baseXp`, labelled the block "Award XP via secure RPC", then returned the number as `xpAwarded` without ever calling any RPC. Every event contribution showed the user a "+N XP" toast for XP that was never actually persisted:

• nothing landed in `xp_ledger`
• `user_stats` stayed stale (no total XP bump, no level check)
• streaks didn't advance for `event_participation` activity
• `event_participation`-gated badges never unlocked
• users grinding an event goal actually reset their motivation vs regular activity because the ledger showed no progress

What changed

• routed the award through `supabase.rpc('award_xp_secure', ...)` — the same RPC that every other client-side award (save_game_score_secure siblings, `gamification.awardXP`) uses
• passed the event context (`event_id`, `contribution`, `cumulative_contribution`, milestones unlocked, `goal_reached`, and `client_computed_xp`) via `p_metadata` so the ledger row is queryable for future auditing
• prefer the RPC's returned `final_xp` so what the UI displays matches what's persisted; fall back to the client-computed value if the RPC omits it
• if `award_xp_secure` errors, keep the contribution row committed (it was written a few steps earlier and rolling it back risks losing user progress) and log the failure — a subsequent retry can catch up

Test plan

• verified there was no prior RPC call anywhere in the function
• confirmed `event_participation` is already a valid ActivityType (gamification.ts:19)
• typecheck clean on supabase.ts
• manual test once maintainer approves: contribute to a community event, verify a new xp_ledger row lands with `activity_type = 'event_participation'` and the p_metadata is populated

Fixes #220

[vercel]

@vedant7007 is attempting to deploy a commit to the arzoorai0207-5745's projects Team on Vercel.

A member of the Team first needs to authorize it.

[vedant7007]

hey! heads up — the failing Verify Codebase check is red because of a pre-existing issue on master: src/App.tsx:13 imports ./pages/Auth but no Auth file exists in src/pages/. every PR opened right now fails on the same import resolution error (see [Failed to resolve import "./pages/Auth" from "src/App.tsx"] in the run log).

this PR doesn't touch App.tsx or anything in src/pages/, so nothing here is causing it. happy to open a separate PR restoring the Auth page (or wiring the route to whatever the intended replacement is) if you can point me at what should live there. thanks!