POST /api/board/game is @InternalOnly and returns 401 for browser clients.
Switch to /api/board/game/vs-bot which is @PermitAll and notifies the
official-bots service to play the bot side automatically.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>