- match-live.js: always forward poll data to game (not only on move_count change)
  This was the root cause — resign/draw don't increment move_count, so the
  game never processed the status change or game_state update
- game.php: all match operations now use supabaseService() to bypass RLS
  (handleGameMove, handleResign, handleComplete all failed silently with user token)
- Add dedicated 'draw' action in game.php that atomically marks match completed
- Draw acceptance now calls action:'draw' instead of writing game_state only
- handleResign validates match isn't already completed (prevents double-resign)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>