feat(pay): 卡密兑换入口收敛到三个购买弹窗并对齐参考主题

- 移除余额卡片独立「卡密兑换」通用弹窗，兑换入口分布到充值/积分/会员三个弹窗的支付方式中
- 充值弹窗补齐卡密 logo 与仅卡密时的金额选择隐藏逻辑
- 积分购买弹窗 1:1 复刻参考主题 points-pay modal（商品档位/自定义/支付方式/立即支付），REST 改为 product+custom 契约
- 会员弹窗注入卡密渠道：视图模型透传 card_pass，前端渲染卡密盒并直兑 /pay/card-pass/redeem type=vip
- 后台卡密兑换拆分为余额/积分/会员三个独立开关，VIP 段旧会员卡密组清理
- REST type 改为必填（balance/vip/credits），三类型独立闸门
- 测试重写为 card-pass-modal-redeem 契约，321 项全部通过

tests/widget-system/toast-contract.test.cjs

@@ -223,10 +223,9 @@ test('balance center actions use direct fixed-id notyf flows', () => {
 
   const flows = [
     [signinController, 'aksrt-balance-signin-toast'],
-    [section('initCardPass', 'initBalanceCharge'), 'aksrt-card-pass-toast'],
     [section('initBalanceCharge', 'initTransfer'), 'aksrt-balance-charge-toast'],
-    [section('initTransfer', 'initPointsExchange'), 'aksrt-balance-transfer-toast'],
-    [section('initPointsExchange', 'initWithdraw'), 'aksrt-balance-points-toast'],
+    [section('initTransfer', 'initPointsPay'), 'aksrt-balance-transfer-toast'],
+    [section('initPointsPay', 'initWithdraw'), 'aksrt-balance-points-toast'],
     [section('initWithdraw', 'initAssetTabs'), 'aksrt-balance-withdraw-toast'],
   ];
 
@@ -242,10 +241,10 @@ test('balance center actions use direct fixed-id notyf flows', () => {
   assert.match(signinController, /freshButtons\.forEach[\s\S]*?addEventListener\('click'/);
   assert.match(credits, /onTimeout:[\s\S]*?notyf\([^;]+?'danger'[^;]+?'aksrt-balance-charge-payment-toast'\)/);
   assert.match(credits, /auto_fun\.aksrt-credits'[\s\S]*?bootAssets\(\);/);
-  assert.match(credits, /function bootAssets\(\)[\s\S]*?initSigninGoto\(\);[\s\S]*?initBalanceCharge\(\);[\s\S]*?initPointsExchange\(\);[\s\S]*?initWithdraw\(\);/);
+  assert.match(credits, /function bootAssets\(\)[\s\S]*?initSigninGoto\(\);[\s\S]*?initBalanceCharge\(\);[\s\S]*?initPointsPay\(\);[\s\S]*?initWithdraw\(\);/);
   assert.doesNotMatch(credits, /function initSignin\(|\/signin\/today|POST \/signin/);
   assert.match(signinController, /aksrtSigninInitialized/);
-  assert.match(credits, /aksrtPointsExchangeInitialized[\s\S]*?aksrtWithdrawInitialized/);
+  assert.match(credits, /aksrtPointsPayInitialized[\s\S]*?aksrtWithdrawInitialized/);
   assert.match(scripts, /'aksrt-credits',[\s\S]*?\/assets\/js\/credits\.js',[\s\S]*?\[[^\]]*'loader_js'[^\]]*\]/);
   assert.match(scripts, /\$signin_on\s*=\s*is_user_logged_in\(\)[\s\S]*?'aksrt-signin',[\s\S]*?\/assets\/js\/signin\.js',[\s\S]*?'loader_js'/);
   assert.ok(header.indexOf('data-signin-btn') < header.indexOf('uc-header__message-btn'));