Add win/lose game-ending flow

Removing all 3 locked files while the timer is still running now marks
the session WON immediately (checked right after every successful rm)
and broadcasts a "game_finished" signal over Mercure so every
connected player gets redirected together, not just the one who
removed the last file. A new /won/{session} route + won.html.twig
mirrors the existing lost flow (victory narrative + the same feedback
form).

The existing timer-expiry path already set LOST but always redirected
to lostUrl regardless of actual status; it now picks won/lost based on
the status the server reports.

Also fixes a pre-existing bug on the lost page (and would-be bug on
the new won page): PlayerService::GetCurrentlyActiveAsPlayer() only
matches players in READY/PLAYING sessions, so by the time a session
has ended it always returned null there, silently breaking the
feedback form. Both pages now look the player up directly via
PlayerRepository instead.

Added a navigatingAway flag so the page's "confirm before leaving"
prompt doesn't block our own win/lose redirects.

templates/game/index.html.twig

@@ -20,6 +20,7 @@
              data-api-echo-url="{{ path('game_api_message')|e('html_attr') }}"
              data-api-check-finished-url="{{ path('game_api_check_finished', {session: session.id})|e('html_attr') }}"
              data-lost-url="{{ path('game_lost', {session: session.id})|e('html_attr') }}"
+             data-won-url="{{ path('game_won', {session: session.id})|e('html_attr') }}"
              data-screen="{{ screen|e('html_attr') }}"
              {% if lock %}
              data-lock-locked-at="{{ lock.lockedAt }}"