Auth slice 3: dev-only fallback + playthrough owner checks

resolveUserId now returns null for an anonymous request in production (no
shared identity); the fixed dev user only applies locally. Player-scoped
routes (create/advance/goto, achievements, reach, notebook, phone, dial)
require a user and verify ownership via ownsPlaythrough — a player can no
longer read or act on another's playthrough. Verified: dev anon still plays;
cross-user access returns 403/404.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/narrativeRepository.ts

@@ -65,6 +65,7 @@ export interface NarrativeRepository {
   phoneDirectory(playthroughId: string): Promise<{ available: boolean; numbers: { number: string; name: string }[] }>
   dial(playthroughId: string, number: string): Promise<{ outcome: 'connect' | 'voicemail' | 'unknown'; name?: string; state?: PlaythroughState }>
   gotoNode(userId: string, playthroughId: string, nodeId: string): Promise<{ ok: boolean; state?: PlaythroughState; error?: string }>
+  ownsPlaythrough(userId: string, playthroughId: string): Promise<boolean>
   listMysteries(): Promise<MysterySummary[]>
   listPlayableMysteries(): Promise<{ slug: string; title: string }[]>
   deleteMystery(id: string): Promise<boolean>
@@ -345,6 +346,10 @@ export function createNarrativeRepository(pool: Pool, objectStorage: ObjectStora
       return npc ? { outcome: 'voicemail', name: npc.name } : { outcome: 'unknown' }
     },
 
+    async ownsPlaythrough(userId, playthroughId) {
+      return ((await pool.query('SELECT 1 FROM osint.playthroughs WHERE id=$1 AND user_id=$2', [playthroughId, userId])).rowCount || 0) > 0
+    },
+
     async listAchievements(playthroughId) {
       if (!(await pool.query('SELECT 1 FROM osint.playthroughs WHERE id=$1', [playthroughId])).rowCount) return null
       const rows = (await pool.query<{ flag_key: string }>('SELECT flag_key FROM osint.achievements WHERE playthrough_id=$1 ORDER BY flag_key', [playthroughId])).rows