Stage 17 round 6 (#10 backend): enforce chat only on your turn

PostMessage now rejects a chat sent on a finished game or when it is not the sender's
turn (ErrChatNotYourTurn -> 409 chat_not_your_turn), matching the UI where the message
field is hidden off-turn and only the nudge shows. Existing chat tests post on the
to-move seat and are unaffected; adds an off-turn-rejection integration test + the dto
mapping case + the UI error message.

backend/internal/server/dto_test.go

@@ -48,6 +48,7 @@ func TestStatusForError(t *testing.T) {
 		"not your turn":  {game.ErrNotYourTurn, http.StatusConflict, "not_your_turn"},
 		"nudge own turn": {social.ErrNudgeOnOwnTurn, http.StatusConflict, "nudge_own_turn"},
 		"nudge too soon": {social.ErrNudgeTooSoon, http.StatusConflict, "nudge_too_soon"},
+		"chat off turn":  {social.ErrChatNotYourTurn, http.StatusConflict, "chat_not_your_turn"},
 		"illegal play":   {engine.ErrIllegalPlay, http.StatusUnprocessableEntity, "illegal_play"},
 		"email taken":    {account.ErrEmailTaken, http.StatusConflict, "email_taken"},
 		"code mismatch":  {account.ErrCodeMismatch, http.StatusUnauthorized, "code_invalid"},