local-dev: auto-purge terminal Dev Sandbox games on every boot

Previously a cancelled / finished / start_failed sandbox game would
hang in the dev user's lobby until manually cleaned up — `make up`
would create a new running game alongside it but the dead tiles
piled up. Now backend's `devsandbox.Bootstrap` deletes every
terminal sandbox game owned by the dev user before find-or-create
runs, so the lobby always shows exactly one running tile.

Schema: `runtime_records` and `player_mappings` gain
`ON DELETE CASCADE` on their `game_id` foreign keys so a single
`DELETE FROM games` cleans every referencing row in one write.
Pre-prod migration rule applies — change goes into
`00001_init.sql`, not a new migration.

API: `lobby.Service.DeleteGame` is the new destructive helper that
backs the bootstrap purge. It bypasses the cancel-cascade-notify
pipeline; production callers must stay on the regular lifecycle.
The dev-sandbox docs in `tools/local-dev/README.md` spell out the
new behaviour.

Tests:
- backend/internal/lobby/lobby_e2e_test.go gains
  `TestDeleteGameCascadesEverything` proving CASCADE works
  end-to-end against a real Postgres testcontainer.
- backend/internal/devsandbox keeps its existing terminal-status
  contract test; the new `purgeTerminalSandboxGames` helper rides
  on the same `terminalSandboxStatus` predicate.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/internal/devsandbox/bootstrap.go

@@ -106,6 +106,10 @@ func Bootstrap(ctx context.Context, deps Deps, cfg config.DevSandboxConfig, logg
 		dummyIDs = append(dummyIDs, id)
 	}
 
+	if err := purgeTerminalSandboxGames(ctx, deps.Lobby, realID, logger); err != nil {
+		return err
+	}
+
 	game, err := findOrCreateSandboxGame(ctx, deps.Lobby, realID, cfg)
 	if err != nil {
 		return err
@@ -158,6 +162,37 @@ func terminalSandboxStatus(status string) bool {
 	return false
 }
 
+// purgeTerminalSandboxGames deletes every previous "Dev Sandbox" game
+// the dev user owns that has reached a terminal state
+// (cancelled / finished / start_failed). The cascade declared in
+// `00001_init.sql` removes the matching memberships, applications,
+// invites, runtime records, and player mappings in the same write,
+// so the developer's lobby never piles up dead tiles between
+// `make rebuild` cycles. Non-terminal games are left untouched —
+// a `running` sandbox from a previous boot is the happy path.
+func purgeTerminalSandboxGames(ctx context.Context, svc *lobby.Service, ownerID uuid.UUID, logger *zap.Logger) error {
+	games, err := svc.ListMyGames(ctx, ownerID)
+	if err != nil {
+		return fmt.Errorf("dev_sandbox: list my games: %w", err)
+	}
+	for _, g := range games {
+		if g.GameName != SandboxGameName || g.OwnerUserID == nil || *g.OwnerUserID != ownerID {
+			continue
+		}
+		if !terminalSandboxStatus(g.Status) {
+			continue
+		}
+		if err := svc.DeleteGame(ctx, g.GameID); err != nil {
+			return fmt.Errorf("dev_sandbox: delete terminal sandbox %s: %w", g.GameID, err)
+		}
+		logger.Info("purged terminal sandbox game",
+			zap.String("game_id", g.GameID.String()),
+			zap.String("status", g.Status),
+		)
+	}
+	return nil
+}
+
 func findOrCreateSandboxGame(ctx context.Context, svc *lobby.Service, ownerID uuid.UUID, cfg config.DevSandboxConfig) (lobby.GameRecord, error) {
 	games, err := svc.ListMyGames(ctx, ownerID)
 	if err != nil {
@@ -167,9 +202,9 @@ func findOrCreateSandboxGame(ctx context.Context, svc *lobby.Service, ownerID uu
 		if g.GameName != SandboxGameName || g.OwnerUserID == nil || *g.OwnerUserID != ownerID {
 			continue
 		}
-		if terminalSandboxStatus(g.Status) {
-			continue
-		}
+		// `purgeTerminalSandboxGames` ran before us, so any sandbox
+		// game still in the list is either a live one we should
+		// reuse or a transient state we can drive forward.
 		return g, nil
 	}
 	rec, err := svc.CreateGame(ctx, lobby.CreateGameInput{

backend/internal/devsandbox/bootstrap_test.go

@@ -80,9 +80,9 @@ func TestBootstrapRejectsMissingDeps(t *testing.T) {
 var errMissingDepsSentinel = errors.New("sentinel")
 
 // TestTerminalSandboxStatus pins the contract that decides whether a
-// previously created sandbox game is reusable. Terminal states force
-// the bootstrap to create a new game on the next boot rather than
-// hand the developer a dead lobby tile.
+// previously created sandbox game gets purged on the next boot.
+// Terminal states are deleted (cascade-style) so the developer's
+// lobby never piles up dead tiles between `make rebuild` cycles.
 func TestTerminalSandboxStatus(t *testing.T) {
 	terminal := []string{"cancelled", "finished", "start_failed"}
 	live := []string{"draft", "enrollment_open", "ready_to_start", "starting", "running", "paused"}