check mobile sri in Challenge.isMine

[tom-anders]

The mobile app uses the following flow to create challenge links to send to other players:

1. Create an open challenge via /api/challenge/open
2. Immediately accept it via /api/challenge/<id>/accept
3. Share the challenge link and listen to the challenge websocket to get notified when a user accepts
4. Once another user accepts, call /api/challenge/<id>/show to get the full ID of the created game

Without this change, if the challenge link was accepted as anonymous, in step 4) the endpoint would return the player ID of the user that accepted the challenge, not the one that created it, because isMine would incorrectly return false. With this change, isMine correctly returns true in this case and the app gets the correct ID, even if the challenge was created anonymously.

[tom-anders]

@ornicar Can you also change this endpoint to AnonOrScoped? Claude gave me something that compiled and seemed to work, but I'm not comfortable enough yet in Scala to add it to the PR

[ornicar]

✔️ compiles
❎ tested