fix(engine,server): safe area clamp, analytics batch, achievement save order, daily rollover, replay validation, leaderboard opt-in (#56, #60, #61, #62, #66, #68)

- #66: Clamp safe-area insets to 25% of window height with warn!() on excess
- #68: Move fire_flush outside per-event loop in analytics (batch flush once)
- #56: Persist progress before marking reward_granted to prevent XP loss on crash
- #60: Add DateRolloverTimer + check_date_rollover system for midnight seed refresh
- #62: Add validate_header() in replay upload with mode/draw_mode allowlists
- #61: Restore two-query leaderboard opt-in check (SELECT then UPDATE); original
       queries already in .sqlx cache; EXISTS variant would require sqlx prepare

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

solitaire_engine/tests/card_face_svg_pin.rs

@@ -19,7 +19,7 @@
 //! shifts that don't affect what a player sees.
 
 use solitaire_engine::assets::card_face_svg::{
-    back_svg, face_svg, rank_filename, suit_filename, ALL_RANKS, ALL_SUITS, BACK_ACCENTS, TARGET,
+    ALL_RANKS, ALL_SUITS, BACK_ACCENTS, TARGET, back_svg, face_svg, rank_filename, suit_filename,
 };
 use solitaire_engine::assets::rasterize_svg;
 
@@ -145,7 +145,9 @@ fn compute_actual_hashes() -> Vec<(String, u64)> {
 
 fn hash_rasterised(svg: &str) -> u64 {
     let image = rasterize_svg(svg.as_bytes(), TARGET).expect("rasterise card SVG");
-    let bytes = image.data.expect("rasterised image carries RGBA pixel data");
+    let bytes = image
+        .data
+        .expect("rasterised image carries RGBA pixel data");
     fnv1a(&bytes)
 }