[Innygr]

Summary

• Add GET /api/multiplayer/current, which returns the signed-in guest's own unfinished match or null.
• On multiplayer page startup, use the existing HttpOnly guest cookie to restore the waiting room or active battle after refresh.
• Add integration coverage for no current match, waiting-match recovery, active-match recovery, isolation from other guests, and ignoring finished matches.

Security notes

• The endpoint never accepts a player ID from the client; it derives identity from the existing guest cookie.
• Match state remains in server memory. This restores after a page refresh while the same server process is running; it does not survive server restarts.

Validation

• The multiplayer integration workflow is enabled for this stacked PR's base branch so CI can run the existing syntax checks and full API test suite.
• This is a draft stacked on PR Add automated multiplayer API integration tests #9 and should be reviewed after the integration-test PR is merged.