feat(anticheat): review signals, replay detection and calibration tooling

[voltcrash]

Summary

Builds out the deferred anticheat work (docs/ANTICHEAT.md) without loosening the "no automatic bans until real samples are reviewed" policy. The only new rejection is a deterministic one (replayed timelines). Everything statistical is log-only and comes with the tooling needed to calibrate it.

• Shared timing stats: moved timing-stats.ts from the frontend event-log viewer into @oxytype/util so the Worker uses the same math.
• Review signals (backend/src/anticheat/signals.ts): uniform-gaps/holds, low-gap/hold-variation, memoryless-timing, small-value-pool. These account for coarsened clocks, IME/sparse telemetry and zero hold placeholders. A flagged result still saves and writes an important anticheat_flagged audit (result id, signals, rounded features). No strikes or bans.
• Replay detection: per-user fingerprints of gaps/holds rounded to whole ms. A recording resubmitted with a new timestamp or flags gets 466 plus an anticheat_rejected (replayed-key-timing) audit. On by default, with its own config, because production leaves lastHashesCheck off.
• Opt-in timing samples: anticheat_sample audits with raw arrays, for flagged results and/or a random baseline. Off by default. These are non-important logs, so the existing 30-day retention and account deletion remove them.
• Escalation: after N flags in a window, the user is marked with the existing suspicious flag. This only adds review logging. Admins can clear it with POST /admin/clearSuspicious.
• Admin review: GET /admin/anticheat/summary (rejections by reason, flags by signal) and GET /admin/anticheat/audits (paged by event/uid). New audit_logs(event, timestamp) index, migration 0007.
• Calibration CLI: pnpm anticheat:calibrate human=a.json bot=b.json prints per-label signal rates and feature percentiles from admin exports.
• Config: new anticheat section (botCheckMinWpm replaces the hard-coded 130, plus review, samples and replayCheck). Defaults keep current enforcement.
• Docs updated (ANTICHEAT.md, PRODUCTION_SETUP.md).

Caveats

• Signal thresholds are uncalibrated placeholders. They were tuned against a seeded hand model and synthetic generators, not real typists. memoryless-timing in particular is a weak signal. Treat flags as leads, not evidence.
• Replay detection is per-user only. Cross-account replays and perturbations of 1 ms or more evade it.
• The migration must be applied on deploy (pnpm db:migrate:production).

Testing

• pnpm oxlint --type-aware --type-check --format agent: clean
• backend pnpm vitest run: 783 passed (incl. D1 tests for review audits, sample capture, replay, escalation and audit queries)
• frontend pnpm vitest run: 1612 passed (modelled human timing through the real client reducers raises no signal)
• util pnpm vitest run: 76 passed
• pnpm build-be: ok

🤖 Generated with Claude Code