Stage 17 round 6 (#10 backend): enforce chat only on your turn

PostMessage now rejects a chat sent on a finished game or when it is not the sender's
turn (ErrChatNotYourTurn -> 409 chat_not_your_turn), matching the UI where the message
field is hidden off-turn and only the nudge shows. Existing chat tests post on the
to-move seat and are unaffected; adds an off-turn-rejection integration test + the dto
mapping case + the UI error message.

backend/internal/social/chat.go

@@ -49,13 +49,22 @@ type Message struct {
 // rune limit, and free of links/emails/phone numbers (the content filter). The
 // gateway-forwarded senderIP is validated and stored for moderation.
 func (svc *Service) PostMessage(ctx context.Context, gameID, senderID uuid.UUID, body, senderIP string) (Message, error) {
-	seats, _, _, err := svc.games.Participants(ctx, gameID)
+	seats, toMove, status, err := svc.games.Participants(ctx, gameID)
 	if err != nil {
 		return Message{}, err
 	}
-	if !slices.Contains(seats, senderID) {
+	idx := slices.Index(seats, senderID)
+	if idx < 0 {
 		return Message{}, ErrNotParticipant
 	}
+	// Chat is allowed only on the sender's own turn in an active game; the opponent's-turn
+	// control is the nudge (Stage 17).
+	if status != statusActive {
+		return Message{}, ErrGameNotActive
+	}
+	if idx != toMove {
+		return Message{}, ErrChatNotYourTurn
+	}
 	sender, err := svc.accounts.GetByID(ctx, senderID)
 	if err != nil {
 		return Message{}, err

backend/internal/social/social.go

@@ -67,6 +67,10 @@ var (
 	ErrNudgeTooSoon = errors.New("social: a nudge was already sent in the last hour")
 	// ErrGameNotActive is returned when a nudge is attempted on a finished game.
 	ErrGameNotActive = errors.New("social: game is not active")
+	// ErrChatNotYourTurn is returned when a chat message is sent while it is not the
+	// sender's turn — chat is allowed only on your own turn (the opponent's-turn control
+	// is the nudge, Stage 17).
+	ErrChatNotYourTurn = errors.New("social: cannot chat while it is not your turn")
 )
 
 // Service is the social domain. It is the only writer of the friendships, blocks