[S4.1-07] Add Authenticated Stats API

[humanauction]

Labels: stage-4, backend, api
Depends on: S4.1-06

Acceptance Criteria:

• Stats endpoint returns total, correct, streak, best streak, and accuracy.
• Endpoint is authenticated and returns 401 when unauthenticated.
• Response contract is documented and tested.
• Performance is acceptable for expected load.