fix(server): XSS, missing score submission, leaderboard never updated, no LIMIT

- leaderboard.html, replays.html: escape user-supplied display_name and
  username before inserting into innerHTML to prevent stored XSS
- game.js: call POST /api/replays on win so browser-game completions are
  recorded; scores were never submitted before this fix
- replays.rs: after replay insert, upsert leaderboard best_score /
  best_time_secs for opted-in users when the new score beats their current
  best (classic mode only); scores were never updated before this fix
- leaderboard.rs: add LIMIT 100 to GET /api/leaderboard to prevent
  unbounded query growth

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

solitaire_server/web/replays.html

@@ -86,6 +86,9 @@
         </table>
     </main>
     <script>
+        function esc(s) {
+            return String(s ?? '').replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
+        }
         function fmtTime(secs) {
             if (!secs) return '—';
             const m = Math.floor(secs / 60), s = secs % 60;
@@ -111,13 +114,13 @@
             status.style.display = 'none';
             const tbody = document.getElementById('tbody');
             tbody.innerHTML = rows.map(r => `
-                <tr onclick="location.href='/replays/${r.id}'">
-                    <td class="player">${r.username ?? '—'}</td>
+                <tr onclick="location.href='/replays/${esc(r.id)}'">
+                    <td class="player">${esc(r.username) || '—'}</td>
                     <td class="score">${r.final_score?.toLocaleString() ?? '—'}</td>
                     <td class="time">${fmtTime(r.time_seconds)}</td>
                     <td class="meta">${r.seed ?? '—'}</td>
-                    <td><span class="draw-badge">Draw ${r.draw_mode ?? '1'}</span></td>
-                    <td><a class="watch-link" href="/replays/${r.id}">Watch &#9654;</a></td>
+                    <td><span class="draw-badge">Draw ${r.draw_mode === 'draw_three' ? '3' : '1'}</span></td>
+                    <td><a class="watch-link" href="/replays/${esc(r.id)}">Watch &#9654;</a></td>
                 </tr>`).join('');
             document.getElementById('table').style.display = 'table';
         }