Traffic Desk: clamp refunds to what was actually bought

A few rows on the network carry a remaining larger than their assigned (a
pre-existing counter quirk), which surfaced as '1,002 returned' on a
1,000-impression ad. Derive served from bought - unserved instead of
trusting the network counter.

Verified live: a text ad with emoji round-tripped through the database
byte-for-byte, then stopped and refunded in full.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

suite-traffic.js

@@ -203,6 +203,12 @@ async function stop(memberId, adId) {
   // `bought` preserves the original order size so the member's history still
   // shows what they launched, not just what it ended up costing them.
   if (row.bought == null) row.bought = row.impressions;
+
+  // A handful of rows on the network carry a `remaining` larger than their
+  // `assigned` (a pre-existing counter quirk). Clamp, or a member sees
+  // "1,002 returned" on an ad they bought 1,000 impressions for.
+  unserved = Math.min(unserved, row.bought);
+  served = row.bought - unserved;
   row.stopped = true;
   row.stoppedAt = new Date().toISOString();
   row.served = served;