Security: the leaderboard is forgeable — `/api/match` takes any name with no forge identity #34

src/server.ts (~135–150) accepts a client-supplied player name with only a self-issued session cookie against matchId collisions; anyone with curl can post a fake score under a real player's name, and there is no rate limit on the endpoint. Done looks like: a match result is attributed to the forge identity of the poster (the signed x-forge-identity/x-forge-signature headers verified with FORGE_APP_IDENTITY_KEY; see the forge's new-app template src/who.ts), guests' results are recorded as guests and never under a named player, the endpoint is rate-limited per identity or socket address, and parseResult (src/result.ts ~39–68) also bounds seconds against rounds. Tests for a forged name refused and a signed one attributed.