api/cron.php still exists as the belt-and-braces tick, but an event must not
depend on someone remembering to wire one up — especially not the one running on
Saturday. The engine now also advances off ordinary traffic, the same way the
matchmaking queue already sweeps its own stale rows:

- browsing the tournament list starts any tournament whose start time has passed
- a player opening their game, or checking their pending games, forfeits an
  opponent who never turned up and closes the round if that was the last board

Both are idempotent and throttled (once every 15-20s per tournament, via APCu or
a temp file), so they cost one query every few seconds rather than one per
request. A game that has actually begun is never forfeited by this path — the
server clock settles those.

Also fixes tournamentEnvInt: `getenv($k) ?: $default` silently discarded a
configured value of "0", because "0" is falsy in PHP.

tests/run.sh now clears its ports before starting and aborts if a server fails
to bind. A stale server from an earlier run had been serving the previous
revision on those ports, so the suite was quietly testing old code — the run
looked like a product failure and was not one.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>