feat(stats): add host match-report review flow

[diese-tech]

What

• adds the private host match-report review page and fragment-token session exchange
• supports sequential screenshot upload, OCR extraction, editable 5v5 correction, identity diagnostics, optimistic save, and host submission
• exposes host_review in the existing admin queue while preserving admin-only final approval
• fails closed for cancelled/terminal reports and inactive or deletion-scheduled roster identities

Why

/report-result currently records a score but does not give the host a secure path to correct OCR-derived player stats before admin approval. This flow makes the web review the single screenshot entry point and keeps official publication behind the database/admin boundary.

Part of #252.

Dependencies and rollout

• Depends on feat: add host-first match stats contract sal-database#103 and the protected publication of immutable db-v1.18.0.
• This branch intentionally remains locked to released db-v1.17.0; after the database release, add a small generated-types/contract-lock pin commit before integration or deployment.
• Configure a dedicated MATCH_REPORT_HOST_SESSION_SECRET of at least 32 characters.
• Screenshot requests are sent one at a time and capped at 4 MB to remain below the Vercel Function request-body limit.

No production deployment or database write was performed.

Verification

• 121 test files passed, 1 skipped
• 772 tests passed, 26 skipped
• npx tsc --noEmit
• npx eslint . --quiet
• npm run check:bem
• npm run check:db-contract (released db-v1.17.0)
• npm run build
• git diff --check origin/main...HEAD

Full Discord → deployed site → protected database staging verification remains gated on db-v1.18.0 and deployment secrets.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sal-draft-league	Ready	Preview	Aug 19, 2026 3:55am

[diese-tech]

Closing as superseded by #265.

#265 carries this branch unchanged and adds the contract pin this PR's rollout notes asked for: "This branch intentionally remains locked to released db-v1.17.0; after the database release, add a small generated-types/contract-lock pin commit before integration or deployment."

That release has shipped and been superseded — production is on db-v1.20.0 — so #265 advances the lock to the current release and re-vendors the generated types via npm run sync:db-contract. The types change is purely additive (702 insertions, zero deletions), and the route handlers in this branch now typecheck against the real RPC signatures instead of the v1.17.0 types that predated them.

Two Codex findings against that branch were also fixed there: the admin review path was discarding host-validated playerId values, and cancelled reports could be revived through the admin upload route. Both have regression coverage.

No work is lost. Continue on #265.

---

Generated by Claude Code