fix(audit): Fortuna pass level, display-name persist, loadout & craft-timer queries

Audit of the emulator surface + 4 fixes:
- Fortuna pass level was frozen: nothing ever granted season XP. ClaimActiveContract
  now grants + persists FortunaPass{2,3}_SeasonXp (scaled to the contract's reputation)
  and returns the new total, so the pass level moves as you complete contracts.
- UpdateUserTitleDisplayName never persisted the rename (echoed back, lost on relog).
  Added DbUserService.UpdateDisplayNameAsync and call it.
- GetPlayerSets returned a blank loadout; now reads the persisted LOADOUT key.
- GetCraftingInProgressData was a stub; now returns the persisted CraftingTimer so an
  in-progress craft + remaining time survive a menu reopen/relog.

Remaining known gaps documented in Plane (need client data / multiplayer / out of scope).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/Prospect.Server.Api/Services/CloudScript/Functions/GetPlayerSets.cs

@@ -1,5 +1,7 @@
-using Prospect.Server.Api.Services.Auth.Extensions;
+using System.Text.Json;
+using Prospect.Server.Api.Services.Auth.Extensions;
 using Prospect.Server.Api.Services.CloudScript.Models;
+using Prospect.Server.Api.Services.UserData;
 
 namespace Prospect.Server.Api.Services.CloudScript.Functions;
 
@@ -7,43 +9,53 @@ namespace Prospect.Server.Api.Services.CloudScript.Functions;
 public class GetPlayerSets : ICloudScriptFunction<FYGetPlayersSets, object?>
 {
     private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
 
-    public GetPlayerSets(IHttpContextAccessor httpContextAccessor)
+    public GetPlayerSets(IHttpContextAccessor httpContextAccessor, UserDataService userDataService)
     {
         _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
     }
-    
-    public Task<object?> ExecuteAsync(FYGetPlayersSets request)
+
+    public async Task<object?> ExecuteAsync(FYGetPlayersSets request)
     {
         var context = _httpContextAccessor.HttpContext;
         if (context == null)
         {
-            return Task.FromResult<object?>(null);
+            return null;
         }
-        
-        return Task.FromResult<object?>(new
+
+        var userId = context.User.FindAuthUserId();
+
+        // Return the player's persisted loadout (written by CompleteInventoryUpdate /
+        // RequestUpdateStationInventory) instead of a blank set, so saved gear survives
+        // a menu reopen / relog. Same response shape as before, just populated.
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string> { "LOADOUT" });
+        var loadout = JsonSerializer.Deserialize<LoadoutData>(userData["LOADOUT"].Value) ?? new LoadoutData();
+
+        return new
         {
             success = true,
-            entries = new []
+            entries = new[]
             {
                 new
                 {
                     setData = new
                     {
                         id = "",
-                        userId = context.User.FindAuthUserId(),
+                        userId,
                         kit = "",
-                        shield = "",
-                        helmet = "",
-                        weaponOne = "",
-                        weaponTwo = "",
-                        bag = "",
-                        bagItemsAsJsonStr = "",
-                        safeItemsAsJsonStr = ""
+                        shield = loadout.Shield ?? "",
+                        helmet = loadout.Helmet ?? "",
+                        weaponOne = loadout.WeaponOne ?? "",
+                        weaponTwo = loadout.WeaponTwo ?? "",
+                        bag = loadout.Bag ?? "",
+                        bagItemsAsJsonStr = loadout.BagItemsAsJsonStr ?? "",
+                        safeItemsAsJsonStr = loadout.SafeItemsAsJsonStr ?? ""
                     },
                     items = Array.Empty<object>()
                 }
             }
-        });
+        };
     }
-}
+}