[P0] Harden fallback /api/runs writes to prevent forged competitive stats

[anshgupta2000]

Motivation

• Prevent client-supplied fallback run payloads from inflating permanent competitive stats and leaderboard outcomes.
• Ensure runs saved via the fallback path (when live finish fails) are treated as unverified and do not update trusted territory or leaderboard counters.
• Sanitize numeric, date, and route inputs and disallow client-provided territory counters for trusted stats.

Description

• Add sanitizeFallbackRunPayload to normalize and clamp distance_km, duration_seconds, avg_pace, started_at, and route_data, and force territories_claimed: 0 and is_verified: false, and export it via __internal for testing.
• Replace direct use of raw request fields in POST /api/runs with sanitized values and stop updating auth_users.total_distance_km and total_runs from client-provided data, returning is_verified: false in the response.
• Add unit tests at apps/web/src/app/api/runs/route.test.ts that assert forged territories_claimed/is_verified are ignored and malformed fields are clamped/normalized.
• Surface live-finish fallback behavior to mobile users by showing an explicit alert in useRunTracker when a run is saved as unverified and when a fallback save fails.

Testing

• Added a focused unit test file src/app/api/runs/route.test.ts to validate the sanitizer logic (test file added to the repo).
• Attempted to run tests via cd druta/apps/web && npm test -- --run src/app/api/runs/route.test.ts src/app/api/runs/live/shared.test.ts, which failed because there is no test script in package.json on the local environment.
• Attempted to run npx vitest run src/app/api/runs/route.test.ts src/app/api/runs/live/shared.test.ts, which failed due to missing local vitest resolution/config startup errors in the current environment.

---

Codex Task