feat(highscores): add SQLite Axum service

Add a small standalone Axum service for the shared anonymous top-ten table.
SQLite keeps the deployment self-contained, while one transaction inserts a
validated name and score and removes entries below the canonical top ten.
Expose a health endpoint and same-origin API, with an nginx proxy block and
run instructions beside the service. Keep the service outside the game crate
so native gameplay persistence remains unchanged.

Test Plan:
- `cargo test --manifest-path highscore-server/Cargo.toml` -- passed (3 tests)
- `cargo clippy --manifest-path highscore-server/Cargo.toml --all-targets --all-features -- -D warnings` -- passed
- `cargo +nightly fmt --manifest-path highscore-server/Cargo.toml -- --check` -- passed
- Live executable health, POST, and GET smoke test -- passed
- `git diff --cached --check` -- passed

tdkpin-rs/highscore-server/README.md

@@ -0,0 +1,28 @@
+# TDK high-score service
+
+This small Axum service stores the shared top-ten table in SQLite. It exposes:
+
+```text
+GET  /healthz
+GET  /api/highscores
+POST /api/highscores
+```
+
+The POST body is JSON with a 21-character maximum name and a `u32` score. The
+response is the canonical top-ten JSON array.
+
+Submissions are anonymous and intentionally trust the browser's score. Add
+rate limiting, moderation, or server-side run verification if the table needs
+to resist forged scores.
+
+Run it from `tdkpin-rs` with:
+
+```sh
+TDKPIN_HIGHSCORE_BIND=127.0.0.1:3000 \
+TDKPIN_HIGHSCORE_DB=/var/lib/tdkpin/highscores.sqlite3 \
+cargo run --manifest-path highscore-server/Cargo.toml
+```
+
+Place [nginx.conf.example](nginx.conf.example) inside the public site's
+existing `server` block. The browser client expects the API at
+`/api/highscores` on the same origin as the game.