Refactor game logic into utility modules and add cross-device sync

Extracted game state management, share logic, and stats API calls into dedicated modules (game-persistence.svelte.ts, share.ts, stats-client.ts), and moved daily verse loading to client-side to fix timezone issues. Added a guesses column to daily_completions for cross-device state restoration for logged-in users, a new GET /api/stats endpoint, and a staging deploy script.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

svelte.config.js

@@ -10,9 +10,8 @@ const config = {
 	kit: {
 		adapter: adapter(),
 		csrf: {
-			// Disabled because Apple Sign In uses cross-origin form_post.
-			// The Apple callback route has its own CSRF protection via state + cookie.
-			checkOrigin: false
+			// Allow Apple Sign In cross-origin form_post callback
+			trustedOrigins: ['https://appleid.apple.com']
 		}
 	}
 };