Add server-side game action validation and anti-cheat checks

[PeaStew]

Summary

Even with interaction attestation, the server should independently validate that game actions are plausible. Client-side checks can always be bypassed — the server must be the authority on what constitutes a valid action.

Recommendation

Server-Side Validation

• Spatial validation: If a user claims to collect an object at location X, verify that the object actually exists at X and the user's last known position makes it reachable in the elapsed time
• Temporal validation: Enforce minimum time between actions (can't collect 10 objects in 1 second)
• Sequence validation: Certain actions require prerequisites (e.g., must visit a location before collecting objects there)
• Duplicate detection: Same object can't be collected twice by the same user
• Session continuity: Actions should come from a continuous session, not sporadic API calls

Reward Throttling

• Cap points earnable per hour/day per account
• Diminishing returns after threshold (first 100 points/day at full rate, next 100 at 50%, etc.)
• This limits the economic incentive for botting even if detection fails

Honeypot Objects

• Place invisible or unreachable objects in the game world
• Any account that collects these is provably using automation
• Immediately flag the account for review

Replay Prevention

• Include a server-issued nonce in each game state update
• Require the nonce in the next action submission
• Prevents replaying captured legitimate requests