feat(contribution): claim the founding award via mutation instead of auto-grant

[idoshamun]

Summary

• Replace the CDC-driven contributionFoundingAward worker with a user-initiated claimContributionFoundingAward mutation, so the award is granted on demand instead of only on a newly-approved-submission event.
• Fixes a real bug: contributors whose approved action predated the worker (or any other missed/undelivered event) could never receive the award, since nothing retroactively grants it. The frontend's "Claim your award" button also had no mutation behind it — this gives it one.
• Along the way: fixed a memberNumber off-by-one caused by JS Date truncating Postgres's microsecond-precision timestamps (now compared entirely server-side via subquery), gated eligibility on "has an approved contribution" rather than "approved points > 0" (a 0-point action is valid), and disambiguated "cap full" vs. "award product misconfigured" so the latter doesn't masquerade as sold-out.

Test plan

• pnpm run build
• pnpm run lint
• NODE_ENV=test npx jest __tests__/contributions.ts --testEnvironment=node --runInBand (29/29 passing, including new claim-mutation tests: success, idempotent re-claim, zero-point eligibility, no-approved-contribution rejection, product-misconfigured error)
• High-effort automated code review run against the diff; 3 findings, all fixed and re-verified

[pulumi]

🍹 The Update (preview) for dailydotdev/api/prod (at dd7158a) was successful.

Resource Changes

    Name                                                       Type                                  Operation
-   api-sub-api.contribution-action-completed-founding         gcp:pubsub/subscription:Subscription  delete
~   vpc-native-update-views-cron                               kubernetes:batch/v1:CronJob           update
~   vpc-native-personalized-digest-cron                        kubernetes:batch/v1:CronJob           update
~   vpc-native-update-source-public-threshold-cron             kubernetes:batch/v1:CronJob           update
~   vpc-native-materialize-monthly-best-post-archives-cron     kubernetes:batch/v1:CronJob           update
~   vpc-native-post-analytics-history-day-clickhouse-cron      kubernetes:batch/v1:CronJob           update
~   vpc-native-deployment                                      kubernetes:apps/v1:Deployment         update
~   vpc-native-clean-zombie-users-cron                         kubernetes:batch/v1:CronJob           update
~   vpc-native-generate-search-invites-cron                    kubernetes:batch/v1:CronJob           update
~   vpc-native-clean-old-notifications-cron                    kubernetes:batch/v1:CronJob           update
~   vpc-native-rotate-weekly-quests-cron                       kubernetes:batch/v1:CronJob           update
~   vpc-native-update-highlighted-views-cron                   kubernetes:batch/v1:CronJob           update
~   vpc-native-sync-subscription-with-cio-cron                 kubernetes:batch/v1:CronJob           update
~   vpc-native-rotate-daily-quests-cron                        kubernetes:batch/v1:CronJob           update
~   vpc-native-update-achievement-rarity-cron                  kubernetes:batch/v1:CronJob           update
~   vpc-native-temporal-deployment                             kubernetes:apps/v1:Deployment         update
~   vpc-native-channel-highlights-cron                         kubernetes:batch/v1:CronJob           update
+   vpc-native-api-db-migration-2d909a11                       kubernetes:batch/v1:Job               create
~   vpc-native-post-analytics-clickhouse-cron                  kubernetes:batch/v1:CronJob           update
~   vpc-native-check-analytics-report-cron                     kubernetes:batch/v1:CronJob           update
~   vpc-native-squad-posts-analytics-refresh-cron              kubernetes:batch/v1:CronJob           update
~   vpc-native-clean-expired-better-auth-sessions-cron         kubernetes:batch/v1:CronJob           update
~   vpc-native-personalized-digest-deployment                  kubernetes:apps/v1:Deployment         update
~   vpc-native-user-profile-updated-sync-cron                  kubernetes:batch/v1:CronJob           update
-   vpc-native-api-db-migration-e725890a                       kubernetes:batch/v1:Job               delete
~   vpc-native-worker-job-deployment                           kubernetes:apps/v1:Deployment         update
~   vpc-native-hourly-notification-cron                        kubernetes:batch/v1:CronJob           update
~   vpc-native-update-tag-materialized-views-cron              kubernetes:batch/v1:CronJob           update
~   vpc-native-post-analytics-achievements-cron                kubernetes:batch/v1:CronJob           update
~   vpc-native-clean-zombie-user-companies-cron                kubernetes:batch/v1:CronJob           update
~   vpc-native-user-profile-analytics-history-clickhouse-cron  kubernetes:batch/v1:CronJob           update
~   vpc-native-ws-deployment                                   kubernetes:apps/v1:Deployment         update
~   vpc-native-clean-zombie-opportunities-cron                 kubernetes:batch/v1:CronJob           update
~   vpc-native-private-deployment                              kubernetes:apps/v1:Deployment         update
~   vpc-native-update-trending-cron                            kubernetes:batch/v1:CronJob           update
~   vpc-native-post-lifecycle-state-clickhouse-cron            kubernetes:batch/v1:CronJob           update
~   vpc-native-generic-referral-reminder-cron                  kubernetes:batch/v1:CronJob           update
~   vpc-native-materialize-yearly-best-post-archives-cron      kubernetes:batch/v1:CronJob           update
~   vpc-native-update-tags-str-cron                            kubernetes:batch/v1:CronJob           update
~   vpc-native-bg-deployment                                   kubernetes:apps/v1:Deployment         update
~   vpc-native-clean-zombie-images-cron                        kubernetes:batch/v1:CronJob           update
... and 16 other changes