Anonymous submissions retain submitter_handle and the API returns it

[royalpinto007]

Problem

The schema allows isAnonymous: true together with authorHandle; the handle is stored and rowToPost returns it without checking isAnonymous (only UI cards mask it). Direct API callers can store and read a handle on an "anonymous" case.

Where

app/api/posts/route.ts + lib/db/posts.ts (rowToPost) vs UI masking.

Acceptance

Add a failing test first submitting isAnonymous: true with a handle, expecting the write to strip it or the read to omit it. Then fix.

[dvd233]

I'd like to work on this. I'll start with a failing route/DB-mapping regression test, then ensure anonymous submissions neither persist nor expose the supplied handle. I'll keep the change scoped to #102 and link the PR when the focused and full checks pass.

[github-actions]

It's yours, @dvd233. Marked this as claimed.

Take your time, and shout in this thread if you get stuck. If there's no activity for 14 days the claim is released so someone else can pick it up.