fix(replay): store the deal via upstream card_game serializers (schema v4)

Replays previously persisted only seed + moves and re-dealt the board
from the seed at playback time, so any change to the seed->deal mapping
(RNG bumps, upstream upgrades) silently invalidated every existing
replay. Schema v4 instead embeds a SessionRecording - the upstream
card_game Session serde ({config, initial_state, instructions}) - so
playback rebuilds the exact recorded board; seed/draw_mode/mode remain
caption metadata only.

- core: SessionRecording newtype delegating to Session<Klondike> serde;
  GameState::recording() / from_recording(); from_instructions_unchecked
  fixture helper; serde_json added to dev-deps (tests only)
- data: Replay v4 (recording replaces moves); v1-v3 files rejected by
  the existing version gate
- engine: win-recording and sync upload freeze game.recording();
  playback rebuilds from the recording; Playing carries the extracted
  move list (+ Box<Replay> for clippy large_enum_variant)
- wasm: replay_export() builds the full v4 upload payload so JS never
  hand-assembles it (the old game.js path hardcoded schema_version: 2
  and corrupted u64 seeds via Math.round); ReplayPlayer::from_json
  enforces schema_version == 4 with a descriptive error
- web: game.js/play.html use replay_export; replay.js surfaces player
  construction errors in the caption instead of dying silently
- server: mode validation accepts data-carrying GameMode variants
  (Difficulty uploads previously 400'd against the String field)

Both replays on prod are May-era v1 rows with empty move lists - every
shared replay was already unplayable; the viewer now says why.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

solitaire_engine/src/sync_plugin.rs

@@ -335,7 +335,11 @@ fn push_replay_on_win(
             ev.time_seconds,
             ev.score,
             Utc::now().date_naive(),
-            recording.moves.clone(),
+            // The live session is the authoritative recording; it
+            // serialises via the upstream card_game serializers so web
+            // playback rebuilds the exact deal instead of re-dealing
+            // the seed.
+            game.0.recording(),
         );
         let provider = provider.0.clone();
         let rt = rt.0.clone();
@@ -621,7 +625,11 @@ mod tests {
             60,
             500,
             chrono::NaiveDate::from_ymd_opt(2026, 5, 6).expect("valid date"),
-            vec![],
+            solitaire_core::SessionRecording::from_instructions_unchecked(
+                7,
+                DrawStockConfig::DrawOne,
+                [],
+            ),
         );
         let history = ReplayHistory {
             schema_version: solitaire_data::REPLAY_HISTORY_SCHEMA_VERSION,