feat(data): replay storage layer with atomic StockClick input

New `solitaire_data::replay` module:
- `Replay` struct: seed + draw_mode + mode + ordered move list +
  presentation metadata (time / score / date). Replays are
  reconstructed by rebuilding `GameState::new_with_mode` and applying
  the move list in order — a deterministic state machine driven by
  atomic player inputs, no per-step snapshots stored.
- `ReplayMove`: one variant per atomic player input. `Move {from, to,
  count}` covers card moves; `StockClick` covers every click on the
  stock (the engine resolves draw-vs-recycle deterministically from
  current state during both record and playback).
- Schema-versioned (`REPLAY_SCHEMA_VERSION = 2`); legacy files are
  rejected via the version gate so older replays just disappear from
  the UI rather than half-loading.
- Atomic save (.tmp -> rename), `dirs::data_dir()`-based path
  resolution. 5 round-trip / atomic / version-gate / corruption tests.

Sync trait extension:
- `SyncProvider::push_replay(&Replay)` — default returns
  `UnsupportedPlatform` so `LocalOnlyProvider` is silently no-op'd by
  the future push-on-win path. Mirrors the existing `pull` / `push`
  default-impl pattern.
- `SolitaireServerClient::push_replay` — `POST /api/replays`, same
  401-refresh-and-retry shape as `push`.

The wire format is the contract: `solitaire_wasm` (added in a later
commit) parses the JSON via its own minimal mirror struct so it can
compile to wasm32 without pulling the desktop client's transitive
deps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

solitaire_data/src/sync_client.rs

@@ -16,6 +16,7 @@ use solitaire_sync::{ChallengeGoal, LeaderboardEntry, SyncPayload, SyncResponse}
 
 use crate::{
     auth_tokens::{load_access_token, load_refresh_token, store_tokens},
+    replay::Replay,
     settings::SyncBackend,
     SyncError, SyncProvider,
 };
@@ -356,6 +357,54 @@ impl SyncProvider for SolitaireServerClient {
 
         extract_leaderboard_body(resp).await
     }
+
+    /// Upload a winning replay to `POST /api/replays`. Mirrors the
+    /// `push` auth flow: 401 triggers a token refresh and one retry.
+    /// Non-success statuses are surfaced as the relevant `SyncError`
+    /// variant so the engine's push-on-win system can downgrade
+    /// network/auth failures into a quiet log without aborting the
+    /// game flow.
+    async fn push_replay(&self, replay: &Replay) -> Result<(), SyncError> {
+        let token = self.access_token()?;
+        let url = format!("{}/api/replays", self.base_url);
+
+        let resp = self
+            .client
+            .post(&url)
+            .bearer_auth(&token)
+            .json(replay)
+            .send()
+            .await
+            .map_err(|e| SyncError::Network(e.to_string()))?;
+
+        if resp.status() == reqwest::StatusCode::UNAUTHORIZED {
+            self.refresh_token().await?;
+            let new_token = self.access_token()?;
+            let resp = self
+                .client
+                .post(&url)
+                .bearer_auth(new_token)
+                .json(replay)
+                .send()
+                .await
+                .map_err(|e| SyncError::Network(e.to_string()))?;
+            return check_replay_status(resp.status());
+        }
+
+        check_replay_status(resp.status())
+    }
+}
+
+fn check_replay_status(status: reqwest::StatusCode) -> Result<(), SyncError> {
+    if status.is_success() {
+        Ok(())
+    } else if status == reqwest::StatusCode::UNAUTHORIZED
+        || status == reqwest::StatusCode::FORBIDDEN
+    {
+        Err(SyncError::Auth(format!("server returned {status}")))
+    } else {
+        Err(SyncError::Network(format!("server returned {status}")))
+    }
 }
 
 // ---------------------------------------------------------------------------