feat(sybil-gate): clearer declined-state recovery CTA

The view-gate 'declined' state (signed-in viewer who withheld the
account-strength scope) walled users without an obvious fix. Minister
now pre-checks the account-strength scope, so re-authenticating shares
it. Sharpen the declined primary CTA into an explicit recovery action
('Share your account strength to get in') on the existing authHref link;
the null-authHref fallback (Minister disabled -> explanatory copy, no
dead button) is unchanged. Presentation only: gate logic
(requireViewBucket / gatePageOrRedirect / buildGateView, fail-closed)
untouched. Add buildGateView unit coverage locking the declined CTA's
authHref data contract in both minister-enabled and -disabled cases.

Author: AtHeartEngineer

src/lib/components/ViewGate.svelte

@@ -40,7 +40,7 @@
 		view.reason === 'signed-out'
 			? 'Sign in with Minister'
 			: view.reason === 'declined'
-				? 'Share and continue'
+				? 'Share your account strength to get in'
 				: view.reason === 'gated'
 					? 'Re-check my account'
 					: 'Re-authenticate with Minister'

src/lib/server/sybil/gate.unit.test.ts

@@ -10,6 +10,7 @@
 import { describe, expect, it } from 'vitest';
 import { instanceSettings, users } from '$lib/server/db/schema';
 import {
+	buildGateView,
 	classifyRow,
 	effectiveBar,
 	requireViewBucket,
@@ -289,3 +290,29 @@ describe('resolveViewerBucket - collapses to number|null, fail-closed', () => {
 		expect(await resolveViewerBucket(sess, fakeDb({ throwOn: 'userSelect' }))).toBe(null);
 	});
 });
+
+describe('buildGateView - declined recovery CTA data contract', () => {
+	// The <ViewGate> declined state renders a primary "share your account strength"
+	// CTA to `authHref`. That link is only actionable when Minister is enabled; when
+	// it is not, `authHref` is null and the component renders explanatory copy
+	// instead of a dead button. These assertions lock the data the CTA depends on.
+	it('declined + minister enabled -> authHref carries a next back to this page', () => {
+		const view = buildGateView(
+			{ ok: false, reason: 'declined', bar: 2 },
+			{ path: '/s/foo?tab=new', ministerEnabled: true }
+		);
+		expect(view.reason).toBe('declined');
+		expect(view.authHref).toBe(
+			`/api/auth/oidc/start?next=${encodeURIComponent('/s/foo?tab=new')}`
+		);
+	});
+
+	it('declined + minister disabled -> authHref null (no dead CTA button)', () => {
+		const view = buildGateView(
+			{ ok: false, reason: 'declined', bar: 2 },
+			{ path: '/s/foo', ministerEnabled: false }
+		);
+		expect(view.reason).toBe('declined');
+		expect(view.authHref).toBeNull();
+	});
+});