fix(server): accept nil user_id placeholder in push; use received_at for leaderboard (#73, #74)

- sync.rs: replace Uuid::nil() placeholder with the authenticated
  user's real UUID before the mismatch check so desktop client pushes
  no longer fail with 400 user_id mismatch (#73)
- replays.rs: use server-computed received_at instead of client-supplied
  header.recorded_at when updating leaderboard recorded_at to prevent
  timestamp spoofing (#74)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

solitaire_server/src/replays.rs

@@ -156,6 +156,8 @@ pub async fn upload(
 
     // Update leaderboard best score/time for opted-in users when this replay
     // beats their existing best. Only classic mode counts for the leaderboard.
+    // Use `received_at` (server-computed) rather than `header.recorded_at`
+    // (client-supplied) so clients cannot spoof the timestamp.
     if header.mode == "Classic" {
         sqlx::query!(
             r#"UPDATE leaderboard
@@ -170,7 +172,7 @@ pub async fn upload(
                  )"#,
             header.final_score,
             header.time_seconds,
-            header.recorded_at,
+            received_at,
             user.user_id,
             header.final_score,
             header.final_score,