P2E: add KYC age region and sanctions gates

[ilyar]

Source PRD: tasks/prd-full-play-to-earn.md
Parent epic: #86
PRD section: US-008

Description

External-value rewards must be blocked until eligibility checks pass where required.

Acceptance Criteria

• Claim flow blocks users without required eligibility checks.
• Eligibility policy supports region allow/deny lists, minimum age, KYC required flag, sanctions screening required flag, and payout-provider account requirements.
• KYC/PII data is not stored in public SpacetimeDB tables.
• Frontend shows clear pending/rejected states without exposing sensitive compliance reasons.
• Admin can see compliance status and provider references, not raw sensitive documents.
• Tests cover eligible, underage, blocked region, missing KYC, failed KYC, and expired KYC cases.

Constraints

• Keep current paid PvP settlement as entry fee, not player-funded prize pool.
• Do not make Season Points redeemable or refundable.
• Keep payout/compliance/provider secrets backend-only.
• Treat this as deferred future-phase work until mechanics/self-host production readiness is stable.

Notes

This likely belongs in private backend storage, not public replicated gameplay tables.