fix(multiplayer): validate contract ticket input

server/api/service.go

@@ -453,6 +453,13 @@ func (s *Service) contractQueueCreate(w http.ResponseWriter, r *http.Request) {
 	}
 	var fields map[string]json.RawMessage
 	if json.Unmarshal(body, &fields) == nil {
+		if rawTicketID, exists := fields["ticket_id"]; exists {
+			var ticketID string
+			if json.Unmarshal(rawTicketID, &ticketID) != nil || !controlPlaneResourceIDRE.MatchString(ticketID) {
+				writeError(w, http.StatusBadRequest, "invalid_request")
+				return
+			}
+		}
 		// Ticket IDs are server-assigned for the public contract. Deriving one
 		// from the authenticated request's idempotency material makes retries
 		// converge on the same domain command without persisting adapter state.