fix(server): XSS, missing score submission, leaderboard never updated, no LIMIT

- leaderboard.html, replays.html: escape user-supplied display_name and
  username before inserting into innerHTML to prevent stored XSS
- game.js: call POST /api/replays on win so browser-game completions are
  recorded; scores were never submitted before this fix
- replays.rs: after replay insert, upsert leaderboard best_score /
  best_time_secs for opted-in users when the new score beats their current
  best (classic mode only); scores were never updated before this fix
- leaderboard.rs: add LIMIT 100 to GET /api/leaderboard to prevent
  unbounded query growth

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

solitaire_server/web/leaderboard.html

@@ -100,6 +100,9 @@
     </main>
     <script>
         const TOKEN_KEY = 'fs_token';
+        function esc(s) {
+            return String(s ?? '').replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
+        }
         function fmtTime(secs) {
             if (!secs) return '—';
             const m = Math.floor(secs / 60), s = secs % 60;
@@ -123,7 +126,7 @@
             tbody.innerHTML = rows.map((r, i) => `
                 <tr>
                     <td class="rank rank-${i+1}">${i+1}</td>
-                    <td>${r.display_name ?? '—'}</td>
+                    <td>${esc(r.display_name) || '—'}</td>
                     <td class="score">${r.best_score?.toLocaleString() ?? '—'}</td>
                     <td class="time">${fmtTime(r.best_time_secs)}</td>
                 </tr>`).join('');