fix(friends): the host can cancel a challenge it sent

decline-invite only accepted the invited player, so a host backing out of the
lobby got 403 and the friend could still accept into an empty game for two
minutes. The host now cancels (result 'cancelled'); the target still declines.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/friends.php

@@ -702,12 +702,15 @@ if ($method === 'POST') {
                 jsonError('Invite not found or expired');
             }
             $gs = is_array($matches[0]['game_state']) ? $matches[0]['game_state'] : json_decode($matches[0]['game_state'] ?? '{}', true);
-            if (($gs['invite_to'] ?? '') !== $userId) {
+            // The invited friend declines; the host who sent it cancels.
+            $isTarget = ($gs['invite_to'] ?? '') === $userId;
+            $isHost = ($gs['invite_from'] ?? '') === $userId;
+            if (!$isTarget && !$isHost) {
                 jsonError('Not authorized to decline this invite', 403);
             }
             $sdb->update('domino_matches', [
                 'status' => 'completed',
-                'result' => 'declined'
+                'result' => $isHost ? 'cancelled' : 'declined'
             ], ['id' => 'eq.' . $matchId, 'status' => 'eq.waiting']);
         } elseif ($gameKey === 'ludo') {
             $matches = $sdb->get('ludo_matches', [
@@ -720,12 +723,15 @@ if ($method === 'POST') {
                 jsonError('Invite not found or expired');
             }
             $gs = is_array($matches[0]['game_state']) ? $matches[0]['game_state'] : json_decode($matches[0]['game_state'] ?? '{}', true);
-            if (($gs['invite_to'] ?? '') !== $userId) {
+            // The invited friend declines; the host who sent it cancels.
+            $isTarget = ($gs['invite_to'] ?? '') === $userId;
+            $isHost = ($gs['invite_from'] ?? '') === $userId;
+            if (!$isTarget && !$isHost) {
                 jsonError('Not authorized to decline this invite', 403);
             }
             $sdb->update('ludo_matches', [
                 'status' => 'completed',
-                'result' => 'declined'
+                'result' => $isHost ? 'cancelled' : 'declined'
             ], ['id' => 'eq.' . $matchId, 'status' => 'eq.waiting']);
         } elseif ($gameKey === 'backgammon') {
             $matches = $sdb->get('backgammon_matches', [
@@ -738,12 +744,15 @@ if ($method === 'POST') {
                 jsonError('Invite not found or expired');
             }
             $gs = is_array($matches[0]['game_state']) ? $matches[0]['game_state'] : json_decode($matches[0]['game_state'] ?? '{}', true);
-            if (($gs['invite_to'] ?? '') !== $userId) {
+            // The invited friend declines; the host who sent it cancels.
+            $isTarget = ($gs['invite_to'] ?? '') === $userId;
+            $isHost = ($gs['invite_from'] ?? '') === $userId;
+            if (!$isTarget && !$isHost) {
                 jsonError('Not authorized to decline this invite', 403);
             }
             $sdb->update('backgammon_matches', [
                 'status' => 'completed',
-                'result' => 'declined'
+                'result' => $isHost ? 'cancelled' : 'declined'
             ], ['id' => 'eq.' . $matchId, 'status' => 'eq.waiting']);
         } else {
             $matches = $sdb->get('matches', [
@@ -756,12 +765,15 @@ if ($method === 'POST') {
                 jsonError('Invite not found or expired');
             }
             $gs = is_array($matches[0]['game_state']) ? $matches[0]['game_state'] : json_decode($matches[0]['game_state'] ?? '{}', true);
-            if (($gs['invite_to'] ?? '') !== $userId) {
+            // The invited friend declines; the host who sent it cancels.
+            $isTarget = ($gs['invite_to'] ?? '') === $userId;
+            $isHost = ($gs['invite_from'] ?? '') === $userId;
+            if (!$isTarget && !$isHost) {
                 jsonError('Not authorized to decline this invite', 403);
             }
             $sdb->update('matches', [
                 'status' => 'completed',
-                'result' => 'declined'
+                'result' => $isHost ? 'cancelled' : 'declined'
             ], ['id' => 'eq.' . $matchId, 'status' => 'eq.waiting']);
         }