Anti-cheat and match audit trail

K-Cricket never trusts browser actions alone. Each action uses a one-time signed token, server-side timestamps, and a committed event hash. Refreshing the browser cannot reroll a completed ball.