1) I setup Auto-Action "Field" for add 1 point each time user login. Points are stored inside integer field cb_points. Now I would like add some restriction for allow 1 point to be addedd but only every 24h. I suppose I must set conditions for check last visit date/time value (a Joomla field?) user was connected AGAINST actual date/time when user login.

You can condition with the [lastvisitdate] substitution. CB Auto Actions supports a number of inline PHP functions for conditions, especially date handling. See "Format Functions" on the Conditions tab of your action at the bottom. You could take the last visit date, add 1 day using strtotime then compare it to todays strtotime date using [cb:date format="Y-m-d H:i:s" /]. Example as follows.

strtotime(+1 DAY,[lastvisitdate]) Less Than strtotime([cb:date format="Y-m-d H:i:s" /])

2) I would like also display a kind of alert message such "Congratulation, you won 10 points" when action is fired. Fields action do not permit that, so I suppose I must try something with Code action ?

You could use a Code action to echo this on the users profile with the before profile display trigger or to add a message queue using the $_CB_framework->enqueueMessage( MSG, TYPE ) function. Another option is to do a redirect on the after login trigger and add your message as the redirect message. You could also output the message using a Custom HTML field and substitution IF statements. Basically you've a lot of options; pick which best fits your needs.

The format is database formatted, don't change it. Enable debug mode under Parameters then enable debug mode and maximum error reporting in Joomla global configuration. Now test your action and see what debug info it dumps. When action debug mode is enabled it'll var_dump any action failures.

You need to have the actions debug mode enabled under Parameters while editing your action. Next in Joomla global configuration you need to enable debug mode and set error reporting to maximum. Now you need to test your action. Since your action works off login, simply login; if the action fails at a conditional or access check it'll dump that information and stop the redirect during login and show it to you.