fix(passport): write PassportStamp when authed users visit a town

[harshithmullapudi]

Bug

Signed-in visitors were seeing 0 stamps on their passport no matter how many towns they walked into. Reproduced from an incident screenshot — a real user (Manik) with a valid passport id and one owned town landed on `/passport` and the right page was blank.

Root cause: the passport read side, the display, the PDF export, the OG image, and the entry toast all shipped in #57. The write-site hook — the actual `PassportStamp` upsert on visit — was called out explicitly in the follow-up section of that PR and never landed.

Fix

• New helper `upsertPassportStamp(userId, townId, townOwnerId)` at `apps/web/src/lib/passport/stamp.ts`. Idempotent on `(userId, townId)`:
  • First visit → creates the row (`firstVisitedAt = now`, `visitCount = 1`).
  • Subsequent visits → bump `lastVisitedAt`, increment `visitCount`.
• No-op if `userId === townOwnerId` — mirrors the schema rule from feat(passport): shareable identity + per-town stamps + PDF export #57. Own-town visits already surface as `TOWNS OWNED: N` on the identity page.
• Called fire-and-forget from the visitor path in `apps/web/src/app/[town]/page.tsx`, right alongside `creditFirstVisitAura` and `recordTownActivity`, and gated on:
  1. `session` exists (CORE-authed viewer)
  2. `session.user.id !== town.ownerId`
• Guests are still handled at read time in `loadGuestPassportData` by aggregating every `town-visit-` cookie in the browser — unchanged.

Related

• Closes the last piece of Passport town stamps: mark every CORE-authenticated town visit #55 (Passport town stamps) — schema, backfill, display, toast were already in; this is the write hook.

Test plan

• Sign in with CORE. Visit a public town you don't own via a valid share code / invite link.
• Immediately visit `/passport` — the town appears as a stamp on the right page, and `0 STAMPS` becomes `1 STAMP` in the subtitle.
• Refresh the same town → `visitCount` increments in the DB, but the stamp gallery doesn't duplicate (first-visit-date locked, `@@unique([userId, townId])` guarantees idempotency).
• Visit your own town → no new stamp row created (owner-filter kicks in).
• Guest mode (incognito) → guest flow still populates from the per-town cookies as before, unchanged.
• Public passport URL `/passport/[passportId]` on the same user now shows the stamp too.

🤖 Generated with Claude Code