Bug: Battle start validation and authorization are incomplete

[tickBit]

What doesn't work?

POST /gameData/battle/start validates that team1 and team2 contain MongoId-shaped strings, but it does not appear to verify that the referenced players actually exist.

It also does not appear to verify that the requester is allowed to start a battle with the provided players/teams.

Some invalid states are only caught later by Mongoose schema validation, for example the same player appearing in both teams, which can result in an internal server error style response instead of a clean API validation response.

What is the endpoint and method? (if applicable)

Endpoint: /gameData/battle/start

Method: POST

How can it be reproduced?

1. Send a request with syntactically valid but non-existing player IDs in team1 and/or team2.
2. Observe that the request can pass DTO validation.
3. Send a request where the same valid player ID appears in both team1 and team2.
4. Observe that the duplicate-player check happens at Mongoose validation time.

What should it do instead?

The endpoint should validate the battle start request at the API/service level before saving.

It should check at least:

• referenced players exist
• the same player is not in both teams
• the requester is allowed to create the battle for those players/teams
• validation failures return clear 400/403 responses instead of uncaught server errors

Anything else you want to add?

There is also a small implementation/documentation mismatch around gameType: registerBattle() sets gameType: 'BATTLE', but then spreads ...dto afterwards, so the client-provided gameType overwrites it.