[API] Match state transition allows skipping veto, checkIntoMatch hardcoded false, fragment NaN

[Flegma]

Summary

Several logic errors in match flow control and API responses.

Findings

• matches.controller.ts — condition uses || instead of &&, allowing match start during Veto.
• matches.controller.ts — checkIntoMatch returns success: false always, regardless of actual result.
• match-relay.controller.ts — parseInt(fragment) with no validation (could be NaN, negative, or huge).

Impact

Matches could skip veto. Clients can never confirm check-in success. Fragment parsing could cause logic errors.

Suggested Fix

Fix boolean operator. Return actual success status. Validate parseInt with bounds checking.