feat(platform): add Reddit Ads client (OAuth2 + token refresh)

docs/api-catalog.md

@@ -373,7 +373,7 @@ pacingLabel: string             — underspending | normal | constrained | overs
 
 ### Reddit Ads
 - Token refresh with expiry buffer (tokens expire; must refresh before expiry)
-- Subreddit targeting uses subreddit IDs, not names
+- Subreddit targeting uses subreddit **names** (the `r/` prefix stripped), not `t5_` IDs — the Ads API `communities` field rejects `t5_` values as "invalid communities" (matches the reference TS implementation, which sends the stripped names directly); if any supplied name is invalid the ad-group create falls back to keyword/geo-only targeting with a warning rather than orphaning the PAUSED campaign
 - Account must be whitelisted in runtime config
 
 ### X/Twitter Ads

docs/knowledge/code/index.md

@@ -5,6 +5,7 @@
 * [internal/infrastructure/config](internal-infrastructure-config.md) - Application configuration from CLI flags and env vars, including PG* composition into a PostgreSQL DSN.
 * [internal/infrastructure/postgres](internal-infrastructure-postgres.md) - PostgreSQL pool (otelpgx), migrations, repositories, and Ready() for readiness probes.
 * [internal/middleware](internal-middleware.md) - Package middleware provides HTTP middleware for the service.
+* [internal/platform/reddit](internal-platform-reddit.md) - Reddit Ads API v3 client: OAuth2 token refresh and Campaign -> Ad Group -> Ad creation.
 * [internal/platform/twitter](internal-platform-twitter.md) - X (Twitter) Ads v12 client: OAuth 1.0a signing and the campaign -> line_item -> promoted_tweet creation flow.
 * [internal/service](internal-service.md) - Campaign service business logic, including Readyz (DB-backed readiness) and Livez (process-only liveness).
 * [pkg/constants](pkg-constants.md) - Application-wide constants, including PG* and DATABASE_URL environment variable names.

docs/knowledge/code/internal-platform-reddit.md

@@ -0,0 +1,45 @@
+---
+type: "Go Package"
+title: "internal/platform/reddit"
+description: "Reddit Ads API v3 client: OAuth2 token refresh and Campaign -> Ad Group -> Ad creation."
+resource: "internal/platform/reddit"
+tags:
+  - platform-client
+  - reddit
+  - reddit-ads
+  - oauth2
+  - go-package
+timestamp: "2026-07-13T23:55:00Z"
+---
+
+# internal/platform/reddit
+
+Package reddit provides a Go client for the Reddit Ads API v3, porting the
+upstream TypeScript `reddit-ads.service.ts` client. Credentials and account
+configuration are injected via `NewClient`; the client never reads the process
+environment.
+
+Authentication uses OAuth 2.0 refresh-token exchange with a cached access token
+and an expiry buffer (refresh shortly before the stated expiry). The token
+endpoint and API base URL are overridable via functional options for `httptest`.
+
+`CreateCampaign` drives the Campaign -> Ad Group -> Promoted Post (Ad) hierarchy,
+creating everything PAUSED with a lifetime budget and objective-aware bid params.
+It normalizes geo targets once (trimmed, uppercased) so the ad-group label,
+targeting, and region derive from a single source of truth, and computes the
+start time up front so a same-day (past midnight-UTC) start is nudged to
+now+buffer before the campaign POST. Post URLs are validated by parsing the URL
+authority (`reddit.com`/`redd.it` and subdomains only) to prevent host spoofing,
+and UTM parameters are merged into the URL query while preserving any fragment.
+
+Supplied subreddit names (`r/golang` or `golang`) are sent to the ad-group
+`communities` targeting field as NAMES with the `r/` prefix stripped (and
+case-insensitive duplicates removed) -- Reddit's Ads API targets communities by
+name, not `t5_` ID, and rejects `t5_` values as "invalid communities". This
+matches the reference TS implementation, which sends the stripped names
+directly. If the ad-group create returns a 400 "invalid communities" the client
+retries once WITHOUT communities (keyword/geo-only) and emits a
+communities-skipped warning step, so an invalid subreddit never orphans the
+PAUSED campaign.
+
+See [internal/platform/reddit](../../../internal/platform/reddit).

docs/knowledge/log.md

@@ -1,5 +1,10 @@
 # Log
 
+## 2026-07-13
+
+**Update** — Added OKF-recommended `tags` and `timestamp` frontmatter to the
+internal/platform/reddit concept doc (queryable fields per OKF v0.1 §4.1).
+
 ## 2026-07-10
 
 **Update** — Addressed Copilot review on the X/Twitter Ads client (PR #19):
@@ -13,6 +18,9 @@ errors instead of masking them as not-found. Added the
 **Update** — Mount connection routes in the HTTP server (LFXV2-2556): the
 `cmd/campaign-service` concept now notes that every container-wired service
 must also be mounted in `server.go`, or its routes 404 despite compiling.
+**Creation** — Added the `internal/platform/reddit` concept doc for the new
+Reddit Ads API v3 client (OAuth2 token refresh + Campaign -> Ad Group -> Ad
+creation) and listed it in the code index.
 
 **Update** — Dropped the Goa CLI path allowlist; twitter-api-secret FP is
 fingerprint-only in `.gitleaksignore`. Clarified `.grype.yaml` rationale