Ledger spend, never a client-only discount

Checkout deducts User.rewardsPoints on a real paid order — never a client-only fake discount.

Kumir never invents a successful rewards spend without deducting User.rewardsPoints on the paid order row. Native apps send rewardsPointsToApply; Android Direct may omit it to auto-apply.

Sandbox and Stripe still require a real Payment. Points are not a fake success path around checkout.