feat(botfights): bump to 1.2.11 — closes 6 IDOR/auth bugs + winnings-claim UI

Ships botfight repo commits f5f57e6, c162d5e, 41f1b93, 10d4209:

- Fixed 6 instances of the same trust-a-client-supplied-pubkey pattern
  across auth/payments/queue routes, two of them critical: GET
  /winnings/:botId had no auth at all and leaked live spendable Cashu
  bearer tokens; POST /connect-wallet let anyone redirect a victim
  bot's future payouts to an attacker's wallet by pubkey (public by
  design in nostr).
- Added owner-reachable AI-answer settings (existing bots, not just at
  creation) and a "claim your winnings" UI (Cashu payouts were minted
  server-side but had no frontend consumer at all until now).

Co-Authored-By: Claude <noreply@anthropic.com>

apps/botfights/manifest.yml

@@ -1,12 +1,12 @@
 app:
   id: botfights
   name: BotFights
-  version: 1.2.9
+  version: 1.2.11
   description: Bot competition arena with 2-player arcade fighting mode. AI bots battle in trivia challenges while humans duke it out with controllers. Built for Bitcoiners.
   category: community
 
   container:
-    image: 146.59.87.168:3000/lfg2025/botfights:1.2.9
+    image: 146.59.87.168:3000/lfg2025/botfights:1.2.11
     pull_policy: always
     # Auto-generated on first install (random hex, 0600, rootless-owned). The
     # 1.2.x image's server/src/middleware/jwt.ts throws at module import when

scripts/image-versions.sh

@@ -90,7 +90,7 @@ FIPS_UI_IMAGE="$ARCHY_REGISTRY/fips-ui:latest"
 ROUTSTR_IMAGE="$ARCHY_REGISTRY/routstr:v0.4.3"
 
 # Community / Gaming
-BOTFIGHTS_IMAGE="$ARCHY_REGISTRY/botfights:1.2.9"
+BOTFIGHTS_IMAGE="$ARCHY_REGISTRY/botfights:1.2.11"
 
 # IndeedHub stack
 INDEEDHUB_IMAGE="$ARCHY_REGISTRY/indeedhub:1.0.0"