feat: complete human-vs-ESP32 gameplay and cumulative statistics

docs/API_CONTRACT.md

@@ -55,6 +55,7 @@ Failure (maximum 160 encoded bytes):
 | `POST /api/game/rematch`   |       80 B body | `{token,gameId}`; common envelope             |
 | `POST /api/game/abort`     |       80 B body | `{token,gameId}`; common envelope             |
 | `GET /api/state?version=N` |    128 B target | one role-safe state, 512 B                    |
+| `GET /api/statistics`      |    128 B target | role and bounded match/cumulative counters    |
 
 The session token is in each POST body. For `GET /api/state`, it is supplied
 in `X-Session-Token`; absence creates a spectator-safe view. It is never a URL
@@ -75,6 +76,16 @@ contain `1`. `winner` is `null` until `finished`, then player index `0` or `1`.
 Each compact statistics tuple is `[shots,hits,misses,shipsSunk]`. No other event
 contains a board.
 
+## Statistics response
+
+`GET /api/statistics` accepts the same optional `X-Session-Token` as state and
+returns no board data. `match` uses `[shots,hits,misses,shipsSunk]` per side;
+`cumulative` uses `[games,wins,losses,shipsSunk,shots,hits,misses]` per side.
+
+```json
+{"ok":true,"viewer":"player1","gameId":4,"match":[[3,2,1,1],[4,1,3,0]],"cumulative":[[2,1,1,10,30,15,15],[2,1,1,8,28,14,14]]}
+```
+
 ## WebSocket
 
 Endpoint: `GET /ws`; all incoming frames are text JSON, at most 192 B. The