fix(review): address PR review findings

- Restore @RolesAllowed("Admin") on official bot creation (security regression)
- Pre-assign UUID before first persist in createOfficialBotAccount/syncOfficialBots
  to eliminate two-persist fragility (token-less entity on second-write failure)
- Add nullable = false to OfficialBotAccount.token column
- Replace JSON string interpolation in publishBotGameStart with objectMapper
- Replace specific hprof PID filename in .gitignore with *.hprof wildcard

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitignore

@@ -53,4 +53,4 @@ modules/tournament/src/main/resources/keys/dev-public.pem
 modules/account/src/main/resources/keys/dev-private.pem
 modules/account/src/main/resources/keys/dev-public.pem
 modules/core/src/main/resources/keys/dev-public.pem
-java_pid2736.hprof
+*.hprof