feat(server): replay upload + fetch endpoints

API surface for the web replay viewer to come:

- `POST /api/replays`        — auth required; persists the JSON body
  verbatim, mints a server-side UUID, returns `{id}`. Three columns
  (final_score, time_seconds, recorded_at) are projected out of the
  payload at insert time so list endpoints don't have to scan blobs.
- `GET  /api/replays/recent` — public; returns the N most-recent
  replays across users (limit defaults to 20, capped at 50). Joins
  the username so the feed reads as "AliceWon · 2:14 win".
- `GET  /api/replays/:id`    — public; returns the full replay JSON
  the desktop client uploaded.

Migration `002_replays.sql` adds the `replays` table with indexes
on `received_at DESC` (recent feed) and `user_id` (per-user views).

Schema-version compatibility is the playback side's responsibility,
matching the desktop's existing `schema_version` gate — the server
just stores and serves whatever JSON came in.

`AppError::NotFound` added so `GET /api/replays/:id` can return a
proper 404 instead of an internal-server-error.

`.sqlx` cache regenerated for the new `query!` invocations.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

solitaire_server/src/lib.rs

@@ -9,6 +9,7 @@ pub mod challenge;
 pub mod error;
 pub mod leaderboard;
 pub mod middleware;
+pub mod replays;
 pub mod sync;
 
 use axum::{
@@ -64,6 +65,7 @@ fn build_router_inner(state: AppState, rate_limit: bool) -> Router {
     let protected = Router::new()
         .route("/api/sync/pull", get(sync::pull))
         .route("/api/sync/push", post(sync::push))
+        .route("/api/replays", post(replays::upload))
         .route("/api/leaderboard", get(leaderboard::get_leaderboard))
         .route("/api/leaderboard/opt-in", post(leaderboard::opt_in))
         .route("/api/leaderboard/opt-in", delete(leaderboard::opt_out))
@@ -98,6 +100,8 @@ fn build_router_inner(state: AppState, rate_limit: bool) -> Router {
     // Public endpoints (no auth, no rate limit beyond defaults).
     let public = Router::new()
         .route("/api/daily-challenge", get(challenge::daily_challenge))
+        .route("/api/replays/recent", get(replays::recent))
+        .route("/api/replays/{id}", get(replays::get_by_id))
         .route("/health", get(health));
 
     Router::new()