INT04-B deferred: finalize live room leaderboards

[hjcud]

What changed

• wire the existing virtual-liquidation, scoring-evidence, and final-result services into a scheduled backend-batch room finalizer
• finalize due LIVE_PAPER segments, complete successful participations, and publish one idempotent immutable FINAL leaderboard
• keep backtest aggregates out of live-room entries and cover the closed-market/no-fill path
• allow terminal evaluation failures without blocking successful bots, while preserving SECRET-room final access for failed participants
• add the exact batch write/lock privileges required by finalization

Why

Production advanced rooms to ENDED but had no runner that assembled the existing finalization services, so a room could never publish its FINAL leaderboard. The deployed batch role also lacked the new finalization write and lock privileges.

Validation

• ./gradlew test --no-daemon --build-cache --parallel — passed
• focused PostgreSQL integration tests for scheduled finalization, failed-participant convergence, SECRET-room access, canonical zero-fill evidence, grant coverage, and idempotent retry — passed

Release impact

The root repository must update the backend pointer, refresh the exact Flyway bundle, run the Development database bootstrap, and deploy a continuously running backend-batch before AWS INT04 is executed.

[hjcud]

Scope update (2026-08-10): this PR is INT04-B LIVE_PAPER work. INT04-A BACKTEST competition is the current MVP priority. Keep this PR draft; do not merge or deploy it, and do not treat it as an INT04-A blocker.