[P0] Lock down race mutations to participants and valid states

[anshgupta2000]

Motivation

• Prevent signed-in users from mutating or finishing races they do not participate in by ensuring only challenger_id === userId || opponent_id === userId can perform race actions.
• Close critical integrity holes where accept, decline, forfeit, and update_distance could be applied by outsiders or in invalid race states.

Description

• Add a shared participant guard via isParticipant(race, userId) immediately after race lookup and return 403 for outsiders.
• Introduce finalized-state guard that blocks mutations when race.status is finished or declined and returns 409 with an explanatory message.
• Enforce action-specific ownership and state checks: restrict accept/decline to the opponent and to pending races, and require active status for update_distance and forfeit.
• Implement explicit forfeit handling that marks the race finished, assigns winner_id/loser_id, updates auth_users wins/losses, and returns the finalized race; and add focused route tests in druta/apps/web/src/app/api/races/route.test.ts covering outsider attempts, finished-race updates, and a valid participant distance update.

Testing

• Added unit tests in druta/apps/web/src/app/api/races/route.test.ts that mock sql, auth, and ensureAuthUser and cover outsider mutation, finished-race rejection, and a successful participant update.
• Attempted to run cd druta/apps/web && npm test -- --run src/app/api/races/route.test.ts, which failed due to no test script in package.json.
• Attempted to run cd druta/apps/web && npx vitest run src/app/api/races/route.test.ts, which failed in this environment due to local vitest dependency/config resolution issues.

---

Codex Task