[S4.1-06] Server-Authoritative Stats Write Path

[humanauction]

Labels: stage-4, backend, security, game
Depends on: S4.1-04, S4.1-05

Acceptance Criteria:

• Guess submission writes attempts/stats on server only.
• Client cannot submit arbitrary score totals.
• Transactional behavior is correct on partial failure.
• Tests prove tampered client payload cannot inflate stats.