fix: save PGN + moves on game end — use service key for DB update

- game.js now sends moves array + move_count alongside PGN
- API uses SUPABASE_SERVICE_KEY instead of user token for PATCH
  (user token may lack permission to update matches table)
- Handles moves as array or string
- This fixes analysis page showing "no moves" after game ends
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

api/game.php

@@ -171,10 +171,17 @@ switch ($action) {
                 'completed_at' => date('c'),
             ];
             if ($moves !== null) {
-                $update['moves'] = json_encode($moves);
-                $update['move_count'] = count($moves);
+                if (is_array($moves)) {
+                    $update['moves'] = json_encode($moves);
+                    $update['move_count'] = count($moves);
+                } else {
+                    $update['moves'] = $moves;
+                }
             }
-            supabase_rest('PATCH', "matches?id=eq.{$gameId}", $update, $token);
+            if (!empty($input['move_count'])) {
+                $update['move_count'] = (int)$input['move_count'];
+            }
+            supabase_rest('PATCH', "matches?id=eq.{$gameId}", $update, SUPABASE_SERVICE_KEY);
         }
 
         // --- Get player profile for ELO/XP/coins updates ---

public/js/game.js

@@ -583,6 +583,8 @@ const Game = {
     this.showResult(title, subtitle);
 
     const result = winner === this.playerColor ? 'win' : (winner ? 'loss' : 'draw');
+    const pgn = this.chess.pgn();
+    const history = this.chess.history();
     App.fetch('/api/game', {
       method: 'POST',
       body: JSON.stringify({
@@ -590,10 +592,12 @@ const Game = {
         game_id: this.gameId,
         result: result,
         reason: reason || 'checkmate',
-        pgn: this.chess.pgn(),
-        final_fen: this.chess.fen()
+        pgn: pgn,
+        final_fen: this.chess.fen(),
+        moves: history,
+        move_count: history.length
       })
-    });
+    }).catch(function() {});
   },
 
   showResult(title, subtitle) {