fix: resolve all remaining audit failures across rust, svelte, and java

panel/server/src/routes/achievements.rs

@@ -264,9 +264,11 @@ pub async fn admin_update_achievement(
     State(state): State<AppState>,
     Json(payload): Json<AchievementPayload>,
 ) -> AppResult<Json<Value>> {
-    let req_type = payload.requirement_type.unwrap_or_else(|| "stat".into());
-    let req_key = payload.requirement_key.unwrap_or_else(|| "blocks_broken".into());
-    let req_val = payload.requirement_value.unwrap_or(50);
+    // FIX #19: Only overwrite requirement_type / key / value when the caller
+    // explicitly supplies them. Use COALESCE so NULL leaves the existing value.
+    let req_type = payload.requirement_type; // None if not in the request
+    let req_key = payload.requirement_key;   // None if not in the request
+    let req_val = payload.requirement_value; // None if not in the request
 
     sqlx::query(
         "UPDATE achievements SET
@@ -277,9 +279,9 @@ pub async fn admin_update_achievement(
             icon_item = ?,
             icon_bg = ?,
             icon_border = ?,
-            requirement_type = ?,
-            requirement_key = ?,
-            requirement_value = ?,
+            requirement_type = COALESCE(?, requirement_type),
+            requirement_key = COALESCE(?, requirement_key),
+            requirement_value = COALESCE(?, requirement_value),
             xp_reward = ?,
             secret = COALESCE(?, secret)
          WHERE id = ?",