feat(gaming): extend admin game list filters

[okapitula]

Summary

Adds category (all-of, plus uncategorized), tag (all-of), game type (any-of) and geo-block filters to GET /backoffice/gaming/games. Stacked on #173: the geo filters read its provider_geo_rule table, so this merges after it.

Why

The admin game list could only filter by search, provider, a single category, isActive and isUnavailable. Operators need to find games by category membership (including games in no category), by tag combinations, by type, and by geo-block status.

• categoryIds[], tagIds[], geoBlockedCountries[] are all-of: a game must match every listed value. gameTypes[] is any-of, since a game has exactly one type.
• A game counts as geo-blocked in a country by its own rule or its provider's, matching the play gate in feat(compliance): add per-provider geo-blocking #173. Country-wide blocks are not included.
• Geo rules are compliance data, so the geo filters require compliance:view on top of game-config:view, the same grant compliance's own geo-rule routes use.
• The geo filters return 400 when the compliance module is not loaded, and contradictory combinations (uncategorized=true with a category filter, geoBlocked=false with countries) return 400.
• Lists accept bracket notation (?tagIds[]=a&tagIds[]=b) or a single bare value; duplicates are dropped before the per-list cap applies.

Alternatives considered

• Revenue and plays range filters: dropped for now. They aggregate game_round, need a date window and a currency to be meaningful, and fit the existing game performance report better than the catalog list.
• A compliance-owned read port for geo rules instead of reading its /schema subpath: the port would return unbounded id lists to feed back into the paginated query; the /schema read is the sanctioned pattern and compliance already reads gaming's tables the same way.

Risks

• Merge order: depends on feat(compliance): add per-provider geo-blocking #173 (provider_geo_rule). Retarget to dev once feat(compliance): add per-provider geo-blocking #173 merges.
• "Compliance loaded" is detected from the GAME_GEO_CHECK binding. An overlay that binds its own geo check without the compliance module would get a 500 instead of a 400 on the geo filters.
• Additive contract change only; the public GET /gaming/games is unchanged.

[zaxovaiko]

Not from this PR, but while checking the filters I noticed game.name has no index, and the public listGames sorts by it. So the lobby's first page and every category page sort all active games on each request: 12.7ms at 30k games and ~40ms at 300k. With index('game_name_idx').on(t.name) it goes down to ~0.3ms, and the category filter drops from ~37ms to ~3ms at 300k.

Let's add it to the game table in gaming/schema/index.ts? It's one index plus a generated migration, so it can land here or in a small separate PR.

[okapitula]

Confirmed, added here with the migration. 300k games:

	before	after
public first page	64 ms	0.3 ms
category page	60 ms	~2-20 ms

The parallel count(*) is now the floor at ~30ms. Also tried game_provider(name, slug) for the admin sort: first page 78 → 3ms, but a no-match q search 182 → 589ms, so left it out.