Anti-cheat: minimum distance + velocity / GPS-spoof validation on claims and conquests

Problem

isClosedLoop (geo.ts:44) only checks start/end within 50m. There is no minimum route length, no velocity sanity check, and no GPS-accuracy/teleport detection — a player can post a tiny fabricated loop or spoofed coordinates to claim/conquer.

Acceptance

• Minimum route length / point count for a valid claim/conquest.
• Reject unrealistic speeds (teleport between points) and obviously synthetic tracks.
• Consider per-point timestamps/accuracy from the recorder.

Done (commit 5f0aeaf). gpx.validateTrackRealism rejects fabricated tracks (teleport jump >2km between consecutive points, or total route <100m), wired into claim + conquest (400, code:'invalid_track'). Verified via harness. Note: true velocity checks need per-point timestamps the recorder doesn't carry yet — left as a follow-up on the issue.