Two problems, one of them mine.

Mine: locking api/game.php's `get` to the two participants broke spectating
outright. Watching a live board is a normal part of a chess event — the profile
"watch" button and the tournament live board both rely on it — and on
championship day it is what most people will be doing. Non-participants now get a
spectator projection: position, clocks, move list, players and result, but no
`my_color` and none of the private game_state (draw offers, heartbeats).

Pre-existing: handleFindActiveMatch ignored the player_id it was given and always
looked up the *caller's* match, so clicking "watch" on someone else silently
opened your own game. It now honours the requested player. The board itself still
goes through `get`, which decides what a spectator may see.

Both lookups are also bounded to the last 12 hours. Production carries 27 matches
stuck in a non-final state since May and July; without that bound, "watch" would
open a game that ended three months ago.

Test-harness hardening in the same commit: pgshim silently ignored any PostgREST
filter it did not implement, so a query with `gte.` matched every row and the test
passed while production filtered correctly. It now implements gte/lte and throws
on anything unrecognised, rather than quietly matching everything.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>