Security hardening: XSS prevention, input validation, rate limiting

Add agent URL hyperlinks, replay downloads, and submit_with_replay endpoint

Revert "Fix CI: import scoring from evaluate_runner instead of openra_rl_util"

Fix CI: import scoring from evaluate_runner instead of openra_rl_util

Add upload form, API endpoint, 5 difficulty tiers, real game data

Fix scoring dedup, add test suite, wire openra-rl-util

Revert "Fix scoring dedup, add test suite, wire openra-rl-util"

Fix scoring dedup, add test suite, wire openra-rl-util