fix: bind queue candidates to their owner

server/domain/queue_test.go

@@ -79,6 +79,20 @@ func TestQueueCreateIdempotencyIncludesCandidatePayload(t *testing.T) {
 	}
 }
 
+func TestQueueCreateRejectsCandidateOwnedByAnotherPlayer(t *testing.T) {
+	q := NewQueue()
+	now := time.Unix(1000, 0)
+	_, err := q.Create("player-a", "ticket-a", "create-key-123456", Candidate{
+		TicketID: "ticket-a", PlayerID: "player-b", EnqueuedAt: now,
+	}, now)
+	if !errors.Is(err, ErrConflict) {
+		t.Fatalf("mismatched candidate owner error = %v", err)
+	}
+	if got := q.Candidates(now); len(got) != 0 {
+		t.Fatalf("mismatched candidate was stored: %+v", got)
+	}
+}
+
 func TestQueueConcurrentCreateKeepsOneActiveTicketPerPlayer(t *testing.T) {
 	q := NewQueue()
 	now := time.Unix(1000, 0)