[AlxcBTW]

Cloud side of network ADR 0041 (anyplaynet/network#133). Behind ANYPLAY_CLOUD_LEADERBOARDS_ENABLED, off by default: every score/board route answers forbidden, the portal reads not_found; the audience setting still works.

• Migration 0033 (SQLite and Postgres): boards, scores, score_privacy.
• leaderboards.rs: best-score entries, boards made by the first score (order/bounds/status are data a moderator sets), ranks counted among the entries the viewer may see (ties share a rank), top / around / friends views, one visibility rule (own, friend unless nobody, stranger only if everyone, blocks both ways, bans out).
• /v1: PUT /me/scores/{title}/{board}, GET /boards/{title}/{board}[/around|/friends], GET /titles/{title}/boards, GET|PUT /me/score-privacy; moderators: configure a board, remove and restore an entry.
• Portal: GET /web/api/v1/boards/{title}/{board} and /titles/{title}/boards, read-only, visitors see only everyone entries.
• Anti-abuse: 60 submissions / account / 10 min, 64 boards per title, 16 boards made per account, 1000 scores per account, bounds per board (default 0..2^53-1), moderator removal that blocks resubmitting until restored.
• Export includes scores and the audience; rows go with the account.
• Tests: crates/cloud/tests/leaderboards.rs (17 tests: flag off, best score, order as data, tied ranks, audiences, no rank gap for hidden players, friends view, around window, blocks, bounds, closed board, removal/restore, moderator account, limits and rate limit, ban, title list, portal visitor vs member, export and deletion).
• network.ref points at the network PR branch head until that PR is merged; I bump it to the merge commit before merging this.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}