Unbloating the Rewards Controller

The rewards controller had grown into a grab-bag of business logic: redemption rules, random game selection, payload shaping, and pagination. It started at 217 lines and was doing far more than routing and rendering. The refactor split that logic into small, named services. The controller now reads params, calls a service, and redirects.