Return container contents in unlock API response

- Add find_object_in_scenario helper to locate objects by ID or name
- Include hasContents and contents fields in unlock response for containers
- Update password and PIN minigames to populate scenarioData.contents from server response
- This allows the container minigame to launch after successful server-side unlock

Without this, the contents field was filtered for security, preventing the container UI from launching.

app/controllers/break_escape/games_controller.rb

@@ -253,10 +253,20 @@ module BreakEscape
           # Object/container unlock
           @game.unlock_object!(target_id)
 
-          render json: {
+          # Find the unlocked object and return its contents if it's a container
+          object_data = find_object_in_scenario(target_id)
+          response = {
             success: true,
             type: 'object'
           }
+
+          # If object has contents, include them in response
+          if object_data && object_data['contents'].present?
+            response[:hasContents] = true
+            response[:contents] = object_data['contents']
+          end
+
+          render json: response
         end
       end
     rescue ActiveRecord::RecordInvalid => e
@@ -383,6 +393,17 @@ module BreakEscape
       nil
     end
 
+    def find_object_in_scenario(object_id)
+      # Search all rooms for the object
+      @game.scenario_data['rooms'].each do |_room_id, room_data|
+        object = room_data['objects']&.find { |obj|
+          obj['id'] == object_id || obj['name'] == object_id
+        }
+        return object if object
+      end
+      nil
+    end
+
     def search_nested_contents(contents, container_id)
       return nil unless contents
 

public/break_escape/js/minigames/password/password-minigame.js

@@ -445,6 +445,11 @@ export class PasswordMinigame extends MinigameScene {
             const response = await apiClient.unlock(targetType, targetId, enteredPassword, 'password');
 
             if (response.success) {
+                // If server returned container contents, populate the lockable object
+                if (response.hasContents && response.contents && lockable.scenarioData) {
+                    console.log('Server returned container contents:', response.contents);
+                    lockable.scenarioData.contents = response.contents;
+                }
                 this.passwordCorrect();
             } else {
                 this.passwordIncorrect();

public/break_escape/js/minigames/pin/pin-minigame.js

@@ -303,6 +303,12 @@ export class PinMinigame extends MinigameScene {
             const apiClient = window.ApiClient || window.APIClient;
             const response = await apiClient.unlock(targetType, targetId, enteredPin, 'pin');
 
+            // If server returned container contents, populate the lockable object
+            if (response.success && response.hasContents && response.contents && lockable.scenarioData) {
+                console.log('Server returned container contents:', response.contents);
+                lockable.scenarioData.contents = response.contents;
+            }
+
             return response.success;
         } catch (error) {
             console.error('Server validation error:', error);