Secure starter submission flow

[KerrikStone]

What changed

• Stop printing public, hidden, and total scores from submit.py; completion now confirms evaluation and links to the public replay.
• Accept the production MLG-XXXX team-card format while retaining the explicit demo code.
• Reject obsolete long codes and ambiguous characters with regression tests.
• Align English and Spanish documentation with the production one-minute cooldown and score-privacy behavior.

Why

The production rehearsal found that generated team cards use short codes such as MLG-BHJ3, but the packaged CLI rejected them before contacting the server. The starter also exposed score fields that the event is intentionally removing and documented an obsolete cooldown.

Impact

Participants can authenticate with the actual printed card, submit normally, and receive a completion/replay link without score leakage.

Validation

• 17 pytest tests passed
• Real-format submit.py login MLG-BHJ3 config flow passed
• Ambiguous and obsolete formats are covered by regression tests
• Diff check passed
• Main application ZIP was rebuilt from this exact source and passed parity/secret checks