fix(review): address PR review findings

- Restore @RolesAllowed("Admin") on official bot creation (security regression)
- Pre-assign UUID before first persist in createOfficialBotAccount/syncOfficialBots
  to eliminate two-persist fragility (token-less entity on second-write failure)
- Add nullable = false to OfficialBotAccount.token column
- Replace JSON string interpolation in publishBotGameStart with objectMapper
- Replace specific hprof PID filename in .gitignore with *.hprof wildcard

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/tournament/src/main/scala/de/nowchess/tournament/service/TournamentService.scala

@@ -1,5 +1,6 @@
 package de.nowchess.tournament.service
 
+import com.fasterxml.jackson.databind.ObjectMapper
 import de.nowchess.tournament.client.{CoreCreateGameRequest, CoreGameClient, CorePlayerInfo, CoreTimeControl}
 import de.nowchess.tournament.config.RedisConfig
 import de.nowchess.tournament.domain.{Tournament, TournamentPairing, TournamentParticipant}
@@ -40,8 +41,9 @@ class TournamentService:
   @RestClient
   var coreGameClient: CoreGameClient = uninitialized
 
-  @Inject var redis: RedisDataSource   = uninitialized
-  @Inject var redisConfig: RedisConfig = uninitialized
+  @Inject var redis: RedisDataSource     = uninitialized
+  @Inject var redisConfig: RedisConfig   = uninitialized
+  @Inject var objectMapper: ObjectMapper = uninitialized
   // scalafix:on
 
   @Transactional
@@ -187,8 +189,15 @@ class TournamentService:
       botAccountId: String,
   ): Unit =
     val channel = s"${redisConfig.prefix}:bot:$botName:events"
-    val payload =
-      s"""{"type":"gameStart","gameId":"$gameId","playingAs":"$playingAs","difficulty":1500,"botAccountId":"$botAccountId"}"""
+    val payload = objectMapper.writeValueAsString(
+      Map(
+        "type"         -> "gameStart",
+        "gameId"       -> gameId,
+        "playingAs"    -> playingAs,
+        "difficulty"   -> 1500,
+        "botAccountId" -> botAccountId,
+      ),
+    )
     Try(redis.pubsub(classOf[String]).publish(channel, payload)) match
       case Failure(ex) => log.warnf(ex, "Failed to publish gameStart to bot channel %s", channel)
       case Success(_)  => ()