fix: address the 15 CodeRabbit findings from the wire-audit review

Security:
- roomcode PUT now requires instance ownership (any player could plant
  or relocate codes on foreign private instances)
- /platformid/{accountId} requires auth (anonymous Steam/Oculus id
  enumeration oracle)
- request tracing no longer captures successful /thread bodies by
  default (chat messages landed unredacted in logs); opt in via
  Trace__SuccessBodyPaths
- anonymous action-link renewal clamped to 720h per consume

Data integrity:
- buyPurchaseReminder upserts its objective sentinel (second purchase
  threw UNIQUE after the wallet was debited)
- progression reward gift + idempotency sentinel commit in one
  transaction (crash between them double-minted the reward)
- ClubPermissionsGalleryAndModeration migration defaults corrected to
  the entity contract (CommentsJson '[]', ClubChatEnabled true); new
  one-shot ClubChatDefaultRepair migration fixes databases that
  applied the wrong defaults; bootstrap repairs '' CommentsJson rows
- admin subroom-maxplayers audit entry commits with the mutation
- account purge covers CustomAvatarItems (ownership deleted, created
  items reassigned to the system account)
- duplicate photo reports ignored while one is unresolved

Stability:
- bootstrap only swallows the expected duplicate-column error; locked
  databases and schema failures now fail startup instead of the first
  endpoint
- clone blob write failure degrades to an empty sub-room instead of a
  500 after the clone row committed
- resumed photo-feed cursor stamped DateTimeKind.Utc (Npgsql rejects
  Unspecified for timestamptz)
- unreadcounts queries per requested room instead of materialising the
  whole comment keyspace

Tests:
- destroys-the-probe-session template guard is case-insensitive

74/74 tests pass.

DorkNet.Server/Controllers/Match/MatchController.cs

@@ -396,14 +396,19 @@ public class MatchController(
                 .Select(p => new { p.Id, p.OwnerPlayerId })
                 .FirstOrDefaultAsync();
 
-            // forceChange only lets a host reclaim a code from one of their OWN
-            // instances; another player's code is never stolen. On refusal the
-            // client just re-reads whatever code we echo back, so we fall
-            // through to the read path instead of erroring.
-            var blocked = clash is not null
-                && (clash.OwnerPlayerId != pid || forceChange != true);
-
             var row = await db.PrivateInstances.FirstOrDefaultAsync(p => p.Id == instanceId);
+
+            // Only the instance's owner may set its code (same guard as
+            // MarkPrivate), otherwise any player could plant or relocate a
+            // code onto someone else's instance. forceChange only lets a host
+            // reclaim a code from one of their OWN instances; another
+            // player's code is never stolen. On refusal the client just
+            // re-reads whatever code we echo back, so we fall through to the
+            // read path instead of erroring.
+            var blocked = row is null || row.OwnerPlayerId != pid
+                || (clash is not null
+                    && (clash.OwnerPlayerId != pid || forceChange != true));
+
             if (!blocked && row is not null)
             {
                 if (clash is not null)