feat: challenge leaderboard (Ticket 1)

[matthewro7263-hub]

Summary

• add challenge_leaderboard_snapshots schema and SQL migration
• add live leaderboard + snapshot routes with Zod validation and requireAuth pattern
• add weekly snapshot cron helper and startup wiring
• add Leaderboard.tsx and wire it into the challenge page
• add brief testing docs for Ticket 1

Notes

• storage.ts still needs the schema spread updated to include challenge_leaderboard_schema if the repo does not auto-import it elsewhere
• snapshot route is public for reads and authed for manual refresh

[matthewro7263-hub]

Review notes before marking Ready for review / merge:

1. Finish the server/storage.ts schema-spread update so challenge_leaderboard_schema is included — noted in the PR description as still pending. Without this, Drizzle won't pick up the new table.
2. Add CI checks (currently 0). At minimum: unit test for the snapshot route Zod validation, and a smoke test for the weekly cron helper (deterministic time).
3. Public snapshot read route — add rate limiting + Cache-Control to avoid abuse on the unauthed read path.
4. The leaderboard query should be capped (e.g., LIMIT 100) and paginated; otherwise an empty WHERE selector could scan the whole snapshot table.
5. Confirm the cron's startup wiring is idempotent on hot-reload (no duplicate intervals).
6. UI: Leaderboard.tsx needs a loading skeleton + empty state before this ships.

Keep-it-free goal: ✅ community/engagement feature, no paywall.

[matthewro7263-hub]

Skipping merge — this one's marked Draft. Scope looks solid (schema + migration, leaderboard routes with Zod + auth, snapshot cron, Leaderboard.tsx wiring). Two notes for when you're ready to mark it ready:

• Make sure storage.ts picks up the new challenge_leaderboard_schema spread (you flagged this yourself).
• Confirm the snapshot route's public-read / authed-refresh split is actually what you want for the leaderboard — worth a security pass before merge.

Ping when it's out of draft.