Require secret leaderboard pass for public rankings

[SinatrasC]

Summary

• Require a matching passed secret leaderboard run on the same submission and runner before public scores appear in ranking APIs, summaries, trend endpoints, rendered leaderboard SQL, and ranking notifications.
• Add API regression coverage for public scores that pass publicly but have no secret leaderboard validation.
• Update the local test DB fixture to include the existing app-expected leaderboard.visibility column.

Testing

• DOCKER_CONFIG=/tmp/docker-config-anon REDIS_URL=redis://localhost:6380/0 uv run --with-requirements requirements.txt pytest -q tests/api/test_leaderboard_api.py
  • 4 passed
• DOCKER_CONFIG=/tmp/docker-config-anon REDIS_URL=redis://localhost:6380/0 uv run --with-requirements requirements.txt pytest -q tests/api/test_leaderboard_summaries_api.py
  • 2 passed
• git diff --check

Note

Legacy rendered-page tests under tests/test_leaderboard.py and tests/test_index.py still fail locally with 302 -> /404; this appears unrelated to the ranking SQL changes.