Reject bingo toggle requests for tiles outside the user's current card

src/routes/bingo/+page.server.ts から始めて、toggle を追跡し、caller の現在の seed 付きカードがどのように構築されるかを確認してから、src/lib/server/standings.ts と loadStandings を調べます。カードに存在しないタイル ID によって進捗を作成または削除できないこと、free space が引き続き no-op であること、そして standings が現在のカードに対する進捗だけをカウントするか、選択された pool 変更時の動作を適用することを検証します。

Problem

toggle verifies that a supplied tile ID exists and is active, but never verifies that the tile is one of the caller current seeded card tiles. Any authenticated user can POST an arbitrary active tileId from the global pool to ?/toggle; a bingo_progress row is inserted and a completion activity is logged.

This is visible in standings because loadStandings uses completedIds.size, which counts every progress row, not just IDs on the displayed card. It also lets players pre-mark tiles that may appear after later pool changes.

Reproduction

1. Configure more tiles than a single card uses.
2. Sign in and obtain the ID of an active tile that is not on the rendered card.
3. Submit POST /bingo?/toggle with that ID.
4. The request succeeds despite no corresponding tile being available to the player; the activity log and leaderboard progress increase.

Suggested fix

Build the caller current seeded card before insertion or removal and return 400 or 403 unless the requested ID is in it (free space remains a no-op). Count only current-card progress in standings, or deliberately clear or migrate off-card progress when the pool changes.

Affected code

• src/routes/bingo/+page.server.ts
• src/lib/server/standings.ts