Challenges: backend model/endpoints + wire create/accept/decline

Problem

Challenges are 100% seed (seedChallenges); '+ New Challenge' is a no-op and there's no Challenge model/table/endpoint.

Acceptance

• Challenge model (creator/participants/territory/goal/dates) + endpoints.
• Wire create + accept/decline + progress tracking.

Done across d75e91d, e516b8c.

Backend — Challenge model (challenger/challenged/territory/area-at-stake/status/winner/deadline); UserNotification gains the challenge type:

• POST /challenges — challenger = session user; the defender + stake are derived from the chosen territory (you challenge whoever holds it). Guards: can't challenge your own territory (400), one open challenge per territory (409). Notifies the defender.
• GET /challenges — the user's sent + received, with names + territory names joined
• POST /challenges/{id}/respond — defender-only accept→active / decline→declined (403/409 guards), notifies the challenger
• POST /challenges/{id}/resolve — participant-only; winner decided by territory ownership at resolution

Frontend — challenges.stx hydrates from the API; '+ New Challenge' opens a modal to pick a rival territory; received-pending cards get Accept/Decline buttons (sent-pending shows 'waiting…'); optimistic via the store. useChallenges composable + game-api client.

Game-logic fix from adversarial review: resolve originally decided the winner from the staked territory's row owner only — but a split conquest leaves that row with the defender and gives the challenger a NEW child territory, so a genuine conqueror was being declared the LOSER. Now credits the challenger if they hold the original OR any split-off child (parent_territory_id). Also: resolve now refuses to settle before the deadline (was exploitable to lock an outcome early).

On the acceptance's 'goal' + 'progress tracking': modeled as area-at-stake + the ownership win-condition, with status badges (PENDING/IN PROGRESS/WON/LOST/DECLINED) as the progress/outcome surface — there's no incremental % meter, which would be a natural follow-up.

Verified by scripts/verify-challenges.ts (20 checks incl. split-conquest winner + deadline guard). All suites green.