Server-authoritative check-in

A scan starts a challenge.
It does not prove a meal.

The server binds a short-lived challenge to this signed-in session, evaluates the chosen proof, decides review/finality, and posts any reward.