Daily Word: server-adjudicate guesses (answer no longer in the response)

Per Codex's v2 hardening. The GET /api/puzzle/word response no longer carries
the answer at all — guesses POST to /api/puzzle/word/guess and the server
returns the colour pattern, computed against the day's answer. The answer (and
the "why") are revealed only once solved or the guesses are spent. This removes
the "open DevTools, read the answer" issue without pretending to be a fortress
(a deliberate crafted request can still peek; there's no leaderboard or prize,
so that's fine). Client keeps local progress/stats; dict validation stays
client-side. Trade-off accepted: each guess needs the API (the site already
depends on it for today's content).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

goodnews/api.py

@@ -334,6 +334,12 @@ class SourcePreview(BaseModel):
     examples_rejected: list[RejectedExample]
 
 
+class WordGuessRequest(BaseModel):
+    variant: str = "5"
+    guess: str
+    n: int = 1  # this guess's position (1-based); the answer is revealed only at n >= max
+
+
 class EmailStartRequest(BaseModel):
     email: str
 
@@ -1430,6 +1436,16 @@ def create_app() -> FastAPI:
         with get_conn() as conn:
             return games.word_puzzle_response(conn, local_today(), variant)
 
+    @app.post("/api/puzzle/word/guess")
+    def word_guess(body: WordGuessRequest) -> dict:
+        if body.variant not in games.WORD_VARIANTS:
+            raise HTTPException(status_code=404, detail="no such puzzle")
+        with get_conn() as conn:
+            res = games.adjudicate_word_guess(conn, local_today(), body.variant, body.guess, body.n)
+        if "error" in res:
+            raise HTTPException(status_code=400, detail=res["error"])
+        return res
+
     @app.get("/api/since", response_model=FeedResponse)
     def feed_since(ts: str = Query(...), prefs: str | None = Query(None)) -> FeedResponse:
         # A calm welcome-back cue: accepted/non-dup/visible articles discovered