Two phones at the same table pressed Join in the same moment, and the loser was told the quiz did not exist

Identity for players who have no account: a row id in localStorage, a resume path that re-validates it, and one pg_advisory_xact_lock around three read-then-write checks.