fix: address the 15 CodeRabbit findings from the wire-audit review

Security:
- roomcode PUT now requires instance ownership (any player could plant
  or relocate codes on foreign private instances)
- /platformid/{accountId} requires auth (anonymous Steam/Oculus id
  enumeration oracle)
- request tracing no longer captures successful /thread bodies by
  default (chat messages landed unredacted in logs); opt in via
  Trace__SuccessBodyPaths
- anonymous action-link renewal clamped to 720h per consume

Data integrity:
- buyPurchaseReminder upserts its objective sentinel (second purchase
  threw UNIQUE after the wallet was debited)
- progression reward gift + idempotency sentinel commit in one
  transaction (crash between them double-minted the reward)
- ClubPermissionsGalleryAndModeration migration defaults corrected to
  the entity contract (CommentsJson '[]', ClubChatEnabled true); new
  one-shot ClubChatDefaultRepair migration fixes databases that
  applied the wrong defaults; bootstrap repairs '' CommentsJson rows
- admin subroom-maxplayers audit entry commits with the mutation
- account purge covers CustomAvatarItems (ownership deleted, created
  items reassigned to the system account)
- duplicate photo reports ignored while one is unresolved

Stability:
- bootstrap only swallows the expected duplicate-column error; locked
  databases and schema failures now fail startup instead of the first
  endpoint
- clone blob write failure degrades to an empty sub-room instead of a
  500 after the clone row committed
- resumed photo-feed cursor stamped DateTimeKind.Utc (Npgsql rejects
  Unspecified for timestamptz)
- unreadcounts queries per requested room instead of materialising the
  whole comment keyspace

Tests:
- destroys-the-probe-session template guard is case-insensitive

74/74 tests pass.

DorkNet.Server/Startup/DatabaseBootstrap.cs

@@ -906,10 +906,24 @@ public static class DatabaseBootstrap
             @"ALTER TABLE ""Clubs"" ADD COLUMN ""ClubChatEnabled"" INTEGER NOT NULL DEFAULT 1;",
             @"ALTER TABLE ""ChatMessages"" ADD COLUMN ""ModerationState"" INTEGER NOT NULL DEFAULT 0;",
             @"ALTER TABLE ""TestCases"" ADD COLUMN ""CommentsJson"" TEXT NOT NULL DEFAULT '[]';",
+            // Repair rows created while the ClubPermissionsGalleryAndModeration
+            // migration carried defaultValue: "" — the empty string is not
+            // valid JSON and made the comment reader throw. Idempotent: ''
+            // is never a legitimate value for this column.
+            @"UPDATE ""TestCases"" SET ""CommentsJson"" = '[]' WHERE ""CommentsJson"" = '';",
         };
         foreach (var sql in sqlite)
         {
-            try { await db.Database.ExecuteSqlRawAsync(sql); } catch { }
+            // Only the duplicate-column error is expected (the column already
+            // exists via Migrate() or a previous boot). Anything else — locked
+            // database, missing table, malformed schema — must fail startup
+            // here rather than as a 500 on the first endpoint that needs the
+            // column.
+            try { await db.Database.ExecuteSqlRawAsync(sql); }
+            catch (Exception ex) when (
+                ex.Message.Contains("duplicate column name", StringComparison.OrdinalIgnoreCase))
+            {
+            }
         }
 
         var sqliteTables = new[]
@@ -940,9 +954,11 @@ public static class DatabaseBootstrap
             """,
             @"CREATE UNIQUE INDEX IF NOT EXISTS ""IX_ClubAdditionalImages_ClubId_Slot"" ON ""ClubAdditionalImages"" (""ClubId"", ""Slot"");",
         };
+        // CREATE ... IF NOT EXISTS is already idempotent; a failure here is a
+        // real problem and must fail startup.
         foreach (var sql in sqliteTables)
         {
-            try { await db.Database.ExecuteSqlRawAsync(sql); } catch { }
+            await db.Database.ExecuteSqlRawAsync(sql);
         }
     }
 

DorkNet.Server/Startup/RequestTracingExtensions.cs

@@ -263,8 +263,13 @@ public static class RequestTracingExtensions
     private static string[] ResolveSuccessBodyPaths()
     {
         var configured = Environment.GetEnvironmentVariable("Trace__SuccessBodyPaths");
+        // "/thread" is deliberately absent from the defaults: successful
+        // thread payloads carry private chat messages, which RedactSecrets
+        // does not touch, and they would land in application logs and
+        // PlayerLogEntry rows. Opt in explicitly via Trace__SuccessBodyPaths
+        // for a short-lived diagnosis instead.
         if (configured is null)
-            return ["/player", "/thread", "/clone", "/rooms/", "/matchmake/"];
+            return ["/player", "/clone", "/rooms/", "/matchmake/"];
 
         return configured
             .Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)