api/cron.php now accepts the Supabase service key as an alternative
credential, so the management app can run the engine without a second
shared secret having to be provisioned on two CapRover apps first, and
takes an optional tournament_id so an organiser pressing Start gets the
answer now instead of at the next sweep.

The sweep also stops skipping tournaments with no round. Flipping a
tournament to in_progress without pairing round one left it registered,
running and permanently unplayable; the sweep now opens the round.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>