Resolve stage: matching, version resolution, fixtures; BGG API auth

bggpipe resolve works end to end: search -> exact/fuzzy candidate
scoring -> auto/ambiguous/unmatched classification with owned-count
tie-breaks (mixed base/expansion candidates never auto-match), version
scoring from edition cues (never guessed; no cues -> version_unknown),
idempotent matches.csv appends.

Discovered mid-build: BGG now requires registered-application Bearer
tokens on the XML API (2025 policy change) and returns 401 otherwise.
Client sends Authorization from BGG_API_TOKEN and raises an actionable
BGGAuthError; CLAUDE.md and the bgg-api skill are updated to match.
Live fixture recording is blocked until registration is approved, so
tests replay hand-crafted stub fixtures via a network-refusing
transport; scripts/record_fixtures.py re-records real XML under the
same cache keys once a token exists. One live read-only smoke test is
skipped unless --run-live.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

data/titles.json

@@ -0,0 +1,40 @@
+[
+  {
+    "title_raw": "Catan",
+    "confidence": "high",
+    "source_photos": ["hand-typed-test-list"]
+  },
+  {
+    "title_raw": "Wingspan",
+    "confidence": "high",
+    "publisher_hint": "Stonemaier Games",
+    "year_hint": 2019,
+    "language_hint": "English",
+    "source_photos": ["hand-typed-test-list"]
+  },
+  {
+    "title_raw": "Wingspan: European Expansion",
+    "confidence": "high",
+    "source_photos": ["hand-typed-test-list"]
+  },
+  {
+    "title_raw": "Wingspan Europe",
+    "confidence": "medium",
+    "source_photos": ["hand-typed-test-list"]
+  },
+  {
+    "title_raw": "Café International",
+    "confidence": "high",
+    "source_photos": ["hand-typed-test-list"]
+  },
+  {
+    "title_raw": "Citadels",
+    "confidence": "high",
+    "source_photos": ["hand-typed-test-list"]
+  },
+  {
+    "title_raw": "Blorvath: Quest of the Zzyzx",
+    "confidence": "low",
+    "source_photos": ["hand-typed-test-list"]
+  }
+]