Auth: nedokoncena registracia sa da dokoncit novym QR kodom

Ucet bez potvrdeneho kodu (auth_token is NULL a totp_last_step == 0)
uz neblokuje meno: opakovany register_account vyda novy secret (stary
QR prestane platit) a login vyhodi RegistrationIncomplete, na ktoru
server odpovie novym QR -- klient sa prepne na registracny tab.
Admin statistiky vykazuju nedokoncene registracie osobitne, Hraci
celkom pocita len potvrdene ucty. Novy event register v analytike.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_stats.py

@@ -58,7 +58,7 @@ class StatsCase(unittest.TestCase):
         for _ in range(n):
             username = "u_" + uuid.uuid4().hex[:8]
             data = run(auth.register_account(username))
-            ident = run(auth.login(username, pyotp.TOTP(data["secret"]).now()))
+            ident = run(auth.confirm_account(username, pyotp.TOTP(data["secret"]).now()))
             ids.append(ident["player_id"])
         return ids
 
@@ -319,6 +319,23 @@ class StatsCase(unittest.TestCase):
         self.assertGreaterEqual(sum(data["games_per_day"].values()), 1)
         self.assertGreaterEqual(sum(data["rounds_per_day"].values()), 4)
 
+    def test_unconfirmed_players_counted_separately(self):
+        before = run(stats.get_daily_stats())
+
+        # Registracia bez potvrdenia kodu -> nedokonceny ucet
+        username = "ghost_" + uuid.uuid4().hex[:8]
+        data = run(auth.register_account(username))
+
+        after = run(stats.get_daily_stats())
+        self.assertEqual(after["total_players"], before["total_players"])
+        self.assertEqual(after["unconfirmed_players"], before["unconfirmed_players"] + 1)
+
+        # Po potvrdeni sa presunie medzi potvrdenych hracov
+        run(auth.confirm_account(username, pyotp.TOTP(data["secret"]).now()))
+        confirmed = run(stats.get_daily_stats())
+        self.assertEqual(confirmed["total_players"], before["total_players"] + 1)
+        self.assertEqual(confirmed["unconfirmed_players"], before["unconfirmed_players"])
+
     def test_empty_referrer_excluded_from_top_referrers(self):
         run(stats.record_pageview(path="/history", referrer="", user_agent=CHROME_UA))
         data = run(stats.get_daily_stats())