fix(multi): resolve 16 bugs from comprehensive rules and code review

Core (solitaire_core):
- fix(core): auto-complete now requires waste empty to prevent deadlock
- fix(core): reject multi-card moves from waste pile (Klondike rule)
- fix(core): reject foundation-to-foundation moves (score farming exploit)
- fix(core): undo restores score from snapshot baseline, not live score
- feat(scoring): add +5 flip bonus when face-down tableau card is exposed
- feat(scoring): add recycle penalty (Draw-1: -100/pass, Draw-3: -20/pass)

Engine (solitaire_engine):
- fix(engine): remove TokioRuntimeResource::default() panic; degrade gracefully
- fix(engine): add ModalScrim guard to handle_new_game spawn site
- fix(engine): add ModalScrim guard to spawn_restore_prompt spawn site
- fix(engine): add ModalScrim guard to check_no_moves spawn site

Server / Web (solitaire_server):
- fix(web): correct draw_mode casing in replay submission (DrawOne/DrawThree)
- fix(web): correct mode casing in replay submission (Classic) for leaderboard
- fix(web): trim recorded_at to YYYY-MM-DD for NaiveDate deserialization
- fix(server): move /avatars route outside auth middleware (was always 401)

Data / Sync (solitaire_data, solitaire_sync):
- fix(data): namespace Android token file under APP_DIR_NAME with migration
- fix(data): Android token store now multi-user (HashMap); no silent overwrite
- fix(sync): draw_one_wins + draw_three_wins invariant preserved after merge

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

solitaire_engine/src/resources.rs

@@ -3,7 +3,7 @@
 use std::sync::Arc;
 
 use bevy::math::Vec2;
-use bevy::prelude::{warn, Resource};
+use bevy::prelude::Resource;
 use chrono::{DateTime, Utc};
 use solitaire_core::game_state::GameState;
 use solitaire_core::pile::PileType;
@@ -146,33 +146,3 @@ impl TokioRuntimeResource {
     }
 }
 
-impl Default for TokioRuntimeResource {
-    fn default() -> Self {
-        // Try multi-threaded first; fall back to current-thread (single
-        // worker) if the OS refuses to create additional threads. Neither
-        // path uses `.expect()` so this never panics at startup.
-        match tokio::runtime::Builder::new_multi_thread()
-            .worker_threads(2)
-            .enable_all()
-            .build()
-        {
-            Ok(rt) => Self(Arc::new(rt)),
-            Err(e) => {
-                warn!(
-                    "sync: failed to build multi-thread Tokio runtime ({e}); \
-                     falling back to current-thread runtime"
-                );
-                // current_thread runtime never spawns OS threads, so it
-                // succeeds even under tight sandboxing.
-                let rt = tokio::runtime::Builder::new_current_thread()
-                    .enable_all()
-                    .build()
-                    .expect(
-                        "current-thread Tokio runtime failed — \
-                         the process cannot do any async I/O",
-                    );
-                Self(Arc::new(rt))
-            }
-        }
-    }
-}