auth: link Steam to UDID-keyed viewer on first authenticated request

After /tool/signup, the client has a viewer_id but no Steam social row.
The first authenticated request (typically /check/game_start) carries
the Steam ticket; if the SteamId lookup misses but the UDID resolves
to a viewer, attach the Steam social now. Subsequent requests hit the
fast SteamId path. Closes the CheckController.GameStart TODO that was
blocking fresh-client boot.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

SVSim.EmulatedEntrypoint/Controllers/CheckController.cs

@@ -30,10 +30,6 @@ public class CheckController : SVSimController
         });
     }
 
-    // TODO: spec lists this as anonymous (identity from SHORT_UDID), but the base controller's
-    // [Authorize] still applies. For now requires a Steam-linked viewer; new-user bootstrap (where
-    // the server creates a viewer + returns rewrite_viewer_id) is deferred until the boot flow is
-    // exercised end-to-end with a real client.
     [HttpPost("game_start")]
     public async Task<GameStartResponse> GameStart(GameStartRequest request)
     {