Add URL-based referral share verification with auto-scraper

Players now paste the URL of their post instead of just clicking a
platform button. The server fetches the URL and looks for the player's
referral code in the page content. If found, the share is auto-approved
and tokens are awarded immediately. If not (login wall, private page,
code missing), it falls into the pending queue with a reason so admins
can click the link directly for manual review.

- api/referrals.php: replace submit_share with URL-accepting version;
  add scrapeForReferralCode() (SSRF-guarded cURL, 8s timeout, 512KB cap)
  and inferPlatformFromUrl() helpers
- db/schema.sql: add share_url, auto_verified, verify_result columns
- index.php: replace platform buttons with URL input form; show auto-
  verify result inline; shares list shows URL and auto-verify badge
- admin/index.php: share cards show clickable URL, auto-check result
  label, and auto-verified tag

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

db/schema.sql

@@ -311,6 +311,9 @@ CREATE TABLE `referral_social_shares` (
   `user_id` int(11) NOT NULL,
   `platform` varchar(50) NOT NULL,
   `bonus_tokens` decimal(10,2) DEFAULT 0.00,
+  `share_url` varchar(500) DEFAULT NULL,
+  `auto_verified` tinyint(1) DEFAULT 0,
+  `verify_result` varchar(100) DEFAULT NULL,
   `status` enum('pending','approved','denied') DEFAULT 'pending',
   `admin_id` int(11) DEFAULT NULL,
   `created_at` datetime DEFAULT current_timestamp(),
@@ -318,7 +321,7 @@ CREATE TABLE `referral_social_shares` (
   PRIMARY KEY (`id`),
   KEY `user_id` (`user_id`),
   CONSTRAINT `referral_social_shares_ibfk_1` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE
-) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 DROP TABLE IF EXISTS `referral_tiers`;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;