fix(prizes): validate minimum score config

apps/web/lib/env.test.ts

@@ -13,25 +13,29 @@ describe("env numeric configuration", () => {
   it("loads valid positive integer limits and USD prices", async () => {
     vi.stubEnv("MAX_IMAGE_UPLOAD_MB", "24");
     vi.stubEnv("MAX_VIDEO_DURATION_SECONDS", "45");
+    vi.stubEnv("PRIZE_MIN_SCORED", "5");
     vi.stubEnv("PRICE_API_ACCESS_USD", "1.50");
 
     const env = await loadEnv();
 
     expect(env.maxImageUploadMb).toBe(24);
     expect(env.maxVideoDurationSeconds).toBe(45);
+    expect(env.prizeMinScored).toBe(5);
     expect(env.priceApiAccessUsd).toBe(1.5);
   });
 
   it("falls back for malformed or non-positive limits", async () => {
     vi.stubEnv("MAX_IMAGE_UPLOAD_MB", "10abc");
     vi.stubEnv("MAX_VIDEO_UPLOAD_MB", "0");
     vi.stubEnv("RSS_CACHE_SECONDS", "1.5");
+    vi.stubEnv("PRIZE_MIN_SCORED", "3abc");
 
     const env = await loadEnv();
 
     expect(env.maxImageUploadMb).toBe(12);
     expect(env.maxVideoUploadMb).toBe(75);
     expect(env.rssCacheSeconds).toBe(300);
+    expect(env.prizeMinScored).toBe(3);
   });
 
   it("falls back for invalid checkout prices", async () => {

apps/web/lib/env.ts

@@ -61,6 +61,7 @@ export const env = {
   maxVideoDurationSeconds: int(process.env.MAX_VIDEO_DURATION_SECONDS, 30),
 
   rssCacheSeconds: int(process.env.RSS_CACHE_SECONDS, 300),
+  prizeMinScored: int(process.env.PRIZE_MIN_SCORED, 3),
   voteSalt: process.env.VOTE_SALT || "dev-vote-salt",
   submissionSalt: process.env.SUBMISSION_SALT || "dev-submission-salt",
   rateLimitSalt: process.env.RATE_LIMIT_SALT || "dev-rate-limit-salt",

apps/web/lib/prizes.ts

@@ -12,7 +12,6 @@ export const BASE_REWARDS: Array<{ kind: string; label: string }> = [
   { kind: "crawlproof_25", label: "25% off CrawlProof.com fill-ups" },
 ];
 
-const PRIZE_MIN_SCORED = Number(process.env.PRIZE_MIN_SCORED || 3);
 const CLAIM_WINDOW_DAYS = 7;
 
 export type PrizeRow = {
@@ -64,7 +63,7 @@ async function winnersForPeriod(startISO: string, endISO: string, limit: number)
           HAVING scored >= ?
           ORDER BY correct DESC, (CAST(correct AS REAL) / scored) DESC, scored DESC, last DESC
           LIMIT ?`,
-    args: [startISO, endISO, PRIZE_MIN_SCORED, limit],
+    args: [startISO, endISO, env.prizeMinScored, limit],
   });
   return res.rows.map((r) => ({ userId: r.user_id as string, correct: Number(r.correct), scored: Number(r.scored) }));
 }