add Carte Blanche trinket: equip system, gatekeeper multi-slot, mini tooltip portal; new token type Token.CARTE ('carte') with fa-money-check icon; migrations 0010-0012:

CARTE type, User.equipped_trinket FK, Token.slots_claimed field; post_save signal sets
equipped_trinket=COIN for new users, PASS for staff; kit bag now shows only the equipped
trinket in Trinkets section; Game Kit applet mini tooltip portal shows Equipped or Equip
Trinket per token; AJAX POST equip-trinket id updates equippedId in-place; equip btn
now works for COIN, PASS, and CARTE (data-token-id added to all three); Gatekeeper CARTE
flow: drop_token sets current_room (no slot reserved); each empty slot up to
slots_claimed+1 gets a drop-token-btn; slots_claimed high-water mark advances on fill,
never decrements; highest CARTE-filled slot gets NVM (release_slot); token_return_btn
resets current_room + slots_claimed + un-fills all CARTE slots; gate_status always returns
full template so launch-game-btn persists via HTMX when gate_status == OPEN; room.html
includes gatekeeper when GATHERING or OPEN; new FT test_trinket_carte_blanche.py (2
tests, both passing); 299 tests green

src/apps/gameboard/static/apps/gameboard/gameboard.js

@@ -1,25 +1,128 @@
+function getCsrfToken() {
+    const match = document.cookie.match(/csrftoken=([^;]+)/)
+    return match ? match[1] : '';
+}
+
 function initGameKitTooltips() {
     const portal = document.getElementById('id_tooltip_portal');
-    if (!portal) return;
+    const miniPortal = document.getElementById('id_mini_tooltip_portal');
+    const gameKit = document.getElementById('id_game_kit');
+    if (!portal || !miniPortal || !gameKit) return;
 
-    document.querySelectorAll('#id_game_kit .token').forEach(token => {
+    let equippedId = gameKit.dataset.equippedId || '';
+    let activeToken = null;
+    let equipping = false;
+
+    function inRect(x, y, r) {
+        return x >= r.left && x <= r.right && y >= r.top && y <= r.bottom;
+    }
+
+    function closePortals() {
+        portal.classList.remove('active');
+        miniPortal.classList.remove('active');
+        miniPortal.style.display = '';
+        activeToken = null;
+    }
+
+    document.addEventListener('mousemove', (e) => {
+        if (portal.classList.contains('active') && activeToken) {
+            const rects = [activeToken.getBoundingClientRect(), portal.getBoundingClientRect()];
+            if (miniPortal.classList.contains('active')) rects.push(miniPortal.getBoundingClientRect());
+            const left   = Math.min(...rects.map(r => r.left));
+            const top    = Math.min(...rects.map(r => r.top));
+            const right  = Math.max(...rects.map(r => r.right));
+            const bottom = Math.max(...rects.map(r => r.bottom));
+            if (!inRect(e.clientX, e.clientY, { left, top, right, bottom })) closePortals();
+        } else if (!portal.classList.contains('active')) {
+            for (const tokenEl of gameKit.querySelectorAll('.token')) {
+                if (!tokenEl.querySelector('.token-tooltip')) continue;
+                if (inRect(e.clientX, e.clientY, tokenEl.getBoundingClientRect())) {
+                    showPortals(tokenEl);
+                    break;
+                }
+            }
+        }
+    });
+
+    function buildMiniContent(tokenId) {
+        if (equippedId && tokenId === equippedId) {
+            miniPortal.textContent = 'Equipped';
+        } else {
+            const btn = document.createElement('button');
+            btn.className = 'equip-trinket-btn';
+            btn.dataset.tokenId = tokenId;
+            btn.textContent = 'Equip Trinket?';
+            btn.addEventListener('click', (e) => {
+                e.stopPropagation();
+                equipping = true;
+                equippedId = tokenId;
+                gameKit.dataset.equippedId = equippedId;
+                fetch(`/gameboard/equip-trinket/${tokenId}/`, {
+                    method: 'POST',
+                    headers: {'X-CSRFToken': getCsrfToken()},
+                }).then(r => {
+                    if (r.ok && equipping) {
+                        equipping = false;
+                        closePortals();
+                    } else {
+                        equipping = false;
+                    }
+                });
+            });
+            miniPortal.innerHTML = '';
+            miniPortal.appendChild(btn);
+        }
+    }
+
+    function showPortals(token) {
+        equipping = false;
+        activeToken = token;
         const tooltip = token.querySelector('.token-tooltip');
-        if (!tooltip) return;
+        portal.innerHTML = tooltip.innerHTML;
+        portal.classList.add('active');
 
-        token.addEventListener('mouseenter', () => {
-            const rect = token.getBoundingClientRect();
-            portal.innerHTML = tooltip.innerHTML;
-            portal.classList.add('active');
-            const halfW = portal.offsetWidth / 2;
-            const rawLeft = rect.left + rect.width / 2;
-            const clampedLeft = Math.max(halfW + 8, Math.min(rawLeft, window.innerWidth - halfW - 8));
-            portal.style.left = Math.round(clampedLeft) + 'px';
-            portal.style.top = Math.round(rect.top) + 'px';
-            portal.style.transform = 'translate(-50%, calc(-100% - 0.5rem))';
-        });
+        const isEquippable = !!token.dataset.tokenId;
+        let miniHeight = 0;
 
-        token.addEventListener('mouseleave', () => {
-            portal.classList.remove('active');
+        if (isEquippable) {
+            buildMiniContent(token.dataset.tokenId);
+            miniPortal.classList.add('active');
+            miniPortal.style.display = 'block';
+            miniHeight = miniPortal.offsetHeight + 4;
+        } else {
+            miniPortal.classList.remove('active');
+            miniPortal.style.display = '';
+        }
+
+        const tokenRect = token.getBoundingClientRect();
+        const halfW = portal.offsetWidth / 2;
+        const rawLeft = tokenRect.left + tokenRect.width / 2;
+        const clampedLeft = Math.max(halfW + 8, Math.min(rawLeft, window.innerWidth - halfW - 8));
+        portal.style.left = Math.round(clampedLeft) + 'px';
+        portal.style.top = Math.round(tokenRect.top) + 'px';
+        portal.style.transform = `translate(-50%, calc(-100% - 0.5rem - ${miniHeight}px))`;
+
+        if (isEquippable) {
+            const mainRect = portal.getBoundingClientRect();
+            miniPortal.style.left = (mainRect.right - miniPortal.offsetWidth) + 'px';
+            miniPortal.style.top = (mainRect.bottom + 4) + 'px';
+        }
+    }
+
+    document.addEventListener('mouseover', (e) => {
+        const tokenEl = e.target.closest('#id_game_kit .token');
+        if (!tokenEl || !tokenEl.querySelector('.token-tooltip')) return;
+        if (!portal.classList.contains('active') || activeToken !== tokenEl) {
+            showPortals(tokenEl);
+        }
+    });
+
+    gameKit.querySelectorAll('.token').forEach(tokenEl => {
+        if (!tokenEl.querySelector('.token-tooltip')) return;
+        tokenEl.addEventListener('mouseenter', () => {
+            if (!portal.classList.contains('active') || activeToken !== tokenEl) {
+                showPortals(tokenEl);
+            }
         });
     });
 }

src/apps/gameboard/urls.py

@@ -6,5 +6,6 @@ from . import views
 urlpatterns = [
     path('', views.gameboard, name='gameboard'),
     path('toggle-applets', views.toggle_game_applets, name='toggle_game_applets'),
+    path('equip-trinket/<int:token_id>/', views.equip_trinket, name='equip_trinket'),
 ]
 

src/apps/gameboard/views.py

@@ -1,6 +1,7 @@
 from django.contrib.auth.decorators import login_required
 from django.db.models import Q
-from django.shortcuts import redirect, render
+from django.http import HttpResponse
+from django.shortcuts import get_object_or_404, redirect, render
 from django.utils import timezone
 
 from apps.applets.utils import applet_context
@@ -20,6 +21,7 @@ GAMEBOARD_APPLET_ORDER = [
 def gameboard(request):
     pass_token = request.user.tokens.filter(token_type=Token.PASS).first() if request.user.is_staff else None
     coin = request.user.tokens.filter(token_type=Token.COIN).first()
+    carte = request.user.tokens.filter(token_type=Token.CARTE).first()
     free_tokens = list(request.user.tokens.filter(
         token_type=Token.FREE, expires_at__gt=timezone.now()
     ).order_by("expires_at"))
@@ -27,6 +29,8 @@ def gameboard(request):
         request, "apps/gameboard/gameboard.html", {
             "pass_token": pass_token,
             "coin": coin,
+            "carte": carte,
+            "equipped_trinket_id": str(request.user.equipped_trinket_id or ""),
             "free_tokens": free_tokens,
             "free_count": len(free_tokens),
             "applets": applet_context(request.user, "gameboard"),
@@ -53,6 +57,8 @@ def toggle_game_applets(request):
             "applets": applet_context(request.user, "gameboard"),
             "pass_token": request.user.tokens.filter(token_type=Token.PASS).first() if request.user.is_staff else None,
             "coin": request.user.tokens.filter(token_type=Token.COIN).first(),
+            "carte": request.user.tokens.filter(token_type=Token.CARTE).first(),
+            "equipped_trinket_id": str(request.user.equipped_trinket_id or ""),
             "free_tokens": list(request.user.tokens.filter(
                 token_type=Token.FREE, expires_at__gt=timezone.now()
             ).order_by("expires_at")),
@@ -66,3 +72,17 @@ def toggle_game_applets(request):
             ).distinct(),
         })
     return redirect("gameboard")
+
+
+@login_required(login_url="/")
+def equip_trinket(request, token_id):
+    token = get_object_or_404(Token, pk=token_id, user=request.user)
+    if request.method == "POST":
+        request.user.equipped_trinket = token
+        request.user.save(update_fields=["equipped_trinket"])
+        return HttpResponse(status=204)
+    return render(
+        request,
+        "apps/gameboard/_partials/_equip_trinket_btn.html",
+        {"token": token},
+    )