fix!(lua.endpoints): buy hangs packs with thin decks

**Ref:** PR #181

## Description

Buying an Arcana or Spectral booster pack causes the endpoint to hang indefinitely when the deck has fewer cards than `hand_limit` (default 8). The response is never sent and the request times out on the client side.

## Root Cause

In `src/lua/endpoints/buy.lua:261`, the completion condition for Arcana/Spectral packs waits for `#G.hand.cards == hand_limit`. When the deck has fewer cards than `hand_limit` (e.g., Abandoned Deck with card destruction, or late-game thin decks), the hand never reaches `hand_limit` cards, so the condition never becomes true and the event loop spins forever.

The same code path in `src/lua/endpoints/pack.lua:331-333` already has the correct fix using `math.min(deck_size, hand_limit)`, but `buy.lua` was never updated.

## Steps to Reproduce

1. Start a run: `start({"deck": "b_abandoned", "stake": "stake_white", "seed": "ISSUE197"})`
2. Select a blind: `select()`
3. Add and use Hanged Man 17 times to destroy cards until deck < 8:
- `add({"key": "c_hanged_man"})` + `use({"consumable": 0, "cards": [0, 1]})` × 17
4. Set chips high to auto-win: `set({"chips": 100000, "money": 50})`
5. Play a hand: `play({"cards": [0]})`
6. Cash out: `cash_out()`
7. Restock shop until an Arcana or Spectral pack appears:
- `set({"shop": true})` + `gamestate()` until `p_arcana_*` or `p_spectral_*` is found
8. Buy the Arcana/Spectral pack: `buy({"pack": 0})`
9. **The request hangs indefinitely** (no response until client timeout at ~15s)

## Expected Behavior

The endpoint should return the gamestate response after the pack opens and the hand is ready, regardless of how many cards are in the deck.

## Actual Behavior

The `buy` request never returns. The condition `#G.hand.cards == hand_limit` at `src/lua/endpoints/buy.lua:261` never becomes true because the deck has fewer cards than `hand_limit`. The connection remains open until the client times out.

## Environment

- **OS:** macOS
- **Lovely version:** 0.8.0
- **SMODS version:** v1.0.0~BETA-1221a
- **BalatroBot commit:** bd376a08acf3

## Files

- [61873.log](https://github.com/user-attachments/files/28879526/61873.log)
- [61873.req.jsonl.txt](https://github.com/user-attachments/files/28879527/61873.req.jsonl.txt)
- [61873.res.jsonl.txt](https://github.com/user-attachments/files/28879528/61873.res.jsonl.txt)