fix(server): load authoritative ratings into ranked candidates

The candidate projection selected only from queue_tickets and its scan
never set Candidate.Rating, so every PostgreSQL-sourced ranked candidate
arrived with Go's zero value. Rating tolerance, selection scoring and
team partitioning all read that field, so ranked matchmaking treated a
900-rated player as identical to a 2100-rated one. Unit tests missed it
because they construct candidates with ratings already populated.

Join the ratings table, defaulting to domain.GlickoInitialRating for a
player with no ratings row yet -- a genuinely new profile, matching the
column default.

Fix the same defect on the Redis path too, which is reached differently:
the projection is seeded from the candidate CreateQueueTicket builds,
not from the candidate query, and that candidate also left Rating unset.
Resolve the rating inside the enqueue transaction so both projections
agree on one authoritative value. The rating is never client-supplied.

Add a store-backed test with deliberately distant ratings (900 vs 2100)
plus an unrated player, asserting both projections and that the spread
survives. Verified it fails without the fix.

server/store/postgres_integration_test.go

@@ -1848,3 +1848,71 @@ func TestPostgreSQLMigrationsRollBackAndReapplyCleanly(t *testing.T) {
 		t.Fatal("reapply after rollback did not recreate the schema")
 	}
 }
+
+// Ranked matchmaking reads Candidate.Rating for tolerance, selection scoring
+// and team partitioning. The candidate projection did not join the ratings
+// table and its scan never set the field, so every PostgreSQL-sourced ranked
+// candidate arrived with Go's zero value and the matcher treated a 900-rated
+// player as identical to a 2100-rated one. Unit tests missed this because they
+// construct candidates with ratings already populated.
+func TestPostgreSQLQueuedCandidatesCarryAuthoritativeRatings(t *testing.T) {
+	db := openIntegrationPostgres(t)
+	applyIntegrationMigrations(t, db)
+
+	now := time.Now().UTC().Truncate(time.Microsecond)
+	ctx := context.Background()
+	// "rated-low" and "rated-high" are deliberately far apart; "unrated" has no
+	// ratings row at all and must fall back to the new-profile default.
+	seeded := map[string]float64{"rated-low": 900, "rated-high": 2100}
+	for _, playerID := range []string{"rated-low", "rated-high", "unrated"} {
+		if _, err := db.ExecContext(ctx, `INSERT INTO identities (player_id, steam_id) VALUES ($1, $2)`, playerID, "steam-"+playerID); err != nil {
+			t.Fatal(err)
+		}
+		if rating, ok := seeded[playerID]; ok {
+			if _, err := db.ExecContext(ctx, `INSERT INTO ratings (player_id, rating) VALUES ($1, $2)`, playerID, rating); err != nil {
+				t.Fatal(err)
+			}
+		}
+		spec := domain.QueueSpec{Playlist: domain.Ranked, ClientBuild: "rating-build", ProtocolVersion: 1}
+		ticket, err := CreateQueueTicket(ctx, db, "ticket-"+playerID, playerID, "rating-create-"+playerID+"-01", spec, now)
+		if err != nil {
+			t.Fatalf("create queue ticket for %s: %v", playerID, err)
+		}
+		// The Redis projection is seeded from this candidate rather than from
+		// the query below, so it must carry the same rating or the two
+		// projections disagree about who is comparable to whom.
+		want := domain.GlickoInitialRating
+		if rating, ok := seeded[playerID]; ok {
+			want = rating
+		}
+		if ticket.Candidate.Rating != want {
+			t.Fatalf("%s enqueue candidate rating = %v, want %v", playerID, ticket.Candidate.Rating, want)
+		}
+	}
+
+	candidates, err := ListQueuedCandidates(ctx, db, domain.Ranked, now, 100)
+	if err != nil {
+		t.Fatalf("list queued candidates: %v", err)
+	}
+	if len(candidates) != 3 {
+		t.Fatalf("expected 3 candidates, got %d", len(candidates))
+	}
+	got := make(map[string]float64, len(candidates))
+	for _, candidate := range candidates {
+		got[candidate.PlayerID] = candidate.Rating
+	}
+	for playerID, want := range map[string]float64{
+		"rated-low": 900, "rated-high": 2100, "unrated": domain.GlickoInitialRating,
+	} {
+		if got[playerID] != want {
+			t.Fatalf("%s durable candidate rating = %v, want %v", playerID, got[playerID], want)
+		}
+	}
+
+	// The whole point of loading the rating is that the matcher can tell these
+	// players apart. Assert the spread survives into team partitioning rather
+	// than only that the field is non-zero.
+	if got["rated-high"]-got["rated-low"] != 1200 {
+		t.Fatalf("rating spread collapsed: %v", got)
+	}
+}