Add persistence layer: TOTP auth, game history, restore

- db/ package: async SQLAlchemy engine + Player/Game/Guess models
- api/auth.py: passwordless TOTP login (pyotp), session token via socket auth
- api/history.py: record guesses/points, DB-backed standings, restore
  unfinished games on startup, host-only end_game
- api/__init__.py: auth-gated handlers, accounts map, rejoin via account
- frontend: Auth (QR + code) and History pages, resume/end-game in lobby/table
- docker-compose: real PostgreSQL service wired via DATABASE_URL
- tests_history.py for the persistence/auth layer; refresh CLAUDE.md

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

requirements.txt

@@ -3,6 +3,12 @@ python-socketio>=5.11
 python-engineio>=4.9
 uvicorn>=0.30
 
+# Persistence layer (history + TOTP auth).
+SQLAlchemy[asyncio]>=2.0
+aiosqlite>=0.20      # dev / default DATABASE_URL
+asyncpg>=0.29        # production (PostgreSQL)
+pyotp>=2.9           # TOTP login
+
 # NOTE: the legacy Flask/Jinja HTTP UI (api/routes.py, api/forms.py,
 # api/templates/) is dormant and its dependencies (Flask, Flask-WTF, etc.)
 # were removed during the ASGI migration. Re-add them only if that UI is revived.