fix: repair broken record_winner API handler (undefined db + wrong signature)

[AliaksandrNazaruk]

Problem

The record_winner action in src/routes/api/shots/+server.js always returns HTTP 500 — it can never record a winner. Two bugs:

1. Signature mismatch. The dispatcher calls handleRecordWinner(request, data) (line 21), but the function was declared handleRecordWinner(winnerData) (line 161). So winnerData was bound to the SvelteKit Request object, and winnerData.winnerAddress was always undefined.
2. Undefined db. The body called db.recordWinner(...), but db is never imported in this module (it only imports verifyJWTSecure, getSupabaseJWTClient, isSupabaseServerAvailable). db.recordWinner is also a browser-only function (reads localStorage), so it could never run server-side. Every call throws ReferenceError → HTTP 500.

By contrast, the sibling record_shot handler works correctly.

Fix

Rewrite handleRecordWinner to mirror the working handleRecordShot:

• Correct (request, winnerData) signature.
• Verify the Bearer JWT via verifyJWTSecure; reject missing/invalid tokens (401).
• Confirm the token's wallet matches winnerData.winnerAddress (403 on mismatch).
• Insert via the existing record_winner_secure RPC (defined in supabase/migrations/20250728150500_simplify_shot_recording.sql, already GRANTed to authenticated), called through getSupabaseJWTClient(token).

Using the existing RPC (rather than a raw table insert) matches how handleRecordShot records shots, and the RPC re-verifies the wallet address server-side (defense in depth) — so there's no RLS ambiguity. No db reference remains; node --check passes.

Impact

Restores the winner-recording endpoint, which is currently 100% broken.