Stage 17 round 5 — backend/correctness bug fixes

- Resign on the opponent's turn: engine ResignSeat(seat) resigns a specific seat
  (not just toMove); game.Resign bypasses the turn check and forfeits the actor's seat.
- Quick-match cancel was a UI no-op (only stopped polling): add the full path
  (REST /lobby/cancel -> gateway lobby.cancel -> client) and clear the matchmaker's
  pending result on Cancel, so a cancelled search is dequeued (no 'already queued', no
  later robot-substituted game). NewGame dequeues on cancel and on abandon.
- Lobby win/loss: result.ts ranked by score, so a 0-0 resignation read as a win.
  The winner now takes rank 1 and the viewer is placed from rank 2 — matching the
  game-detail screen.
- Friend request to a robot: robots no longer block requests; the request stays
  pending and expires (friendRequestTTL), mirroring a human who ignores it.
- Nudge cooldown: ErrNudgeTooSoon now maps to a distinct nudge_too_soon code with a
  correct message; the chat nudge button disables during the hourly cooldown; the
  nudge note reads 'Waiting for your move!' (button keeps the Nudge action label).
Tests: engine/service off-turn resign, matchmaker cancel-clears-result, friend-to-robot
inttest, result.ts 0-0 resignation, nudge_too_soon mapping.

backend/internal/server/dto_test.go

@@ -47,6 +47,7 @@ func TestStatusForError(t *testing.T) {
 		"not a player":   {game.ErrNotAPlayer, http.StatusForbidden, "not_a_player"},
 		"not your turn":  {game.ErrNotYourTurn, http.StatusConflict, "not_your_turn"},
 		"nudge own turn": {social.ErrNudgeOnOwnTurn, http.StatusConflict, "nudge_own_turn"},
+		"nudge too soon": {social.ErrNudgeTooSoon, http.StatusConflict, "nudge_too_soon"},
 		"illegal play":   {engine.ErrIllegalPlay, http.StatusUnprocessableEntity, "illegal_play"},
 		"email taken":    {account.ErrEmailTaken, http.StatusConflict, "email_taken"},
 		"code mismatch":  {account.ErrCodeMismatch, http.StatusUnauthorized, "code_invalid"},

backend/internal/server/handlers.go

@@ -69,6 +69,7 @@ func (s *Server) registerRoutes() {
 	}
 	if s.matchmaker != nil {
 		u.POST("/lobby/enqueue", s.handleEnqueue)
+		u.POST("/lobby/cancel", s.handleCancel)
 		u.GET("/lobby/poll", s.handlePoll)
 	}
 	if s.invitations != nil {
@@ -200,9 +201,12 @@ func statusForError(err error) (int, string) {
 	case errors.Is(err, session.ErrNotFound):
 		return http.StatusUnauthorized, "session_invalid"
 	case errors.Is(err, social.ErrChatBlocked), errors.Is(err, social.ErrMessageTooLong),
-		errors.Is(err, social.ErrEmptyMessage), errors.Is(err, social.ErrForbiddenContent),
-		errors.Is(err, social.ErrNudgeTooSoon):
+		errors.Is(err, social.ErrEmptyMessage), errors.Is(err, social.ErrForbiddenContent):
 		return http.StatusUnprocessableEntity, "chat_rejected"
+	case errors.Is(err, social.ErrNudgeTooSoon):
+		// A too-frequent nudge is a distinct, non-content rejection — the UI must say
+		// "don't rush the player so often", not the chat content-rejection message.
+		return http.StatusConflict, "nudge_too_soon"
 	case errors.Is(err, social.ErrSelfRelation):
 		return http.StatusBadRequest, "self_relation"
 	case errors.Is(err, social.ErrRequestExists):

backend/internal/server/handlers_user.go

@@ -153,6 +153,20 @@ func (s *Server) handleEnqueue(c *gin.Context) {
 	c.JSON(http.StatusOK, dto)
 }
 
+// handleCancel removes the caller from the auto-match pool (and drops any pending
+// matched result), so a cancelled quick-match neither blocks a re-queue nor later
+// surfaces a robot-substituted game the player abandoned. It is idempotent: cancelling
+// when not queued is a no-op success.
+func (s *Server) handleCancel(c *gin.Context) {
+	uid, ok := userID(c)
+	if !ok {
+		abortBadRequest(c, "missing identity")
+		return
+	}
+	s.matchmaker.Cancel(c.Request.Context(), uid)
+	c.Status(http.StatusNoContent)
+}
+
 // handlePoll reports whether the caller has been paired since queueing.
 func (s *Server) handlePoll(c *gin.Context) {
 	uid, ok := userID(c)