Write grants (TRUNCATE included) were still open to anon and authenticated;
nothing on the client writes tournaments. Applied.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>