challenges.php:
- Reads challenge_templates from DB instead of hardcoded array
- Admin can add/remove/edit challenge types via management panel
- Fallback to 3 basic challenges if DB is empty

battlepass.php:
- Reads active season from 'seasons' table instead of hardcoded config
- Admin can create new seasons, set dates, tiers, XP requirements
- Fallback to Season 1 defaults if no active season

Both APIs now fully driven by database:
- Management panel writes to tables → Player app reads automatically
- No more hardcoded game config in PHP files
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>