refactor: unify identity resolution on stable user_id (anon_token)

There were two identity systems: SessionManager keyed on the stable, UNIQUE
anon_token, and getOrCreateUser keyed on the mutable, non-unique socket_id.
The latter could create a duplicate "orphan" user row (or resolve the wrong
row) when the socket_id lookup raced the session's socket_id update —
desyncing credits and payouts between the two rows for one human.

- getOrCreateUser now resolves through SessionManager's stable identity first
  (anon_token -> users.id), re-selecting a fresh row by stable id, and only
  falls back to the legacy socket_id lookup when no session exists. The
  last-resort create now warns, since it indicates a missing session.
- gameModeManager.sessionManager is wired in SocketHandlers so the
  session-first path is active in production.
- anon_token is already UNIQUE (migration 003), so the stable-identity
  constraint already exists; no new migration needed.

Re-keying the in-memory activeGames map by user_id is deferred (invasive;
already mitigated by stamping dbUserId on the game in the disconnect fix).

Adds identityResolution.test.js proving no duplicate row is created when a
session exists. Full suite: 17 suites / 136 tests.

src/network/socketHandlers.js

@@ -67,6 +67,9 @@ class SocketHandlers {
                 debugManager: this.debugManager,
                 gameModeManager: this.gameModeManager
             });
+            // IDENTITY (Phase 2.1): give GameModeManager the session manager so getOrCreateUser
+            // resolves through the stable anon_token identity instead of the mutable socket_id.
+            this.gameModeManager.sessionManager = this.sessionManager;
             // Initialize cleanup timers
             this.sessionManager.initialize().catch(err => {
                 console.error('Failed to initialize SessionManager:', err);