server: validate client-reported hit geometry

[acts-1631]

The server accepts client-reported hitsets from N_DESTROY after only checking sender ownership and shot ID. In destroyevent::process in src/game/server.cpp, the non-projectile-hit path uses client-supplied target, flags, distance, direction, and velocity to call dodamage(). A connected player can therefore report damage for a target that was not intersected by the shot, enabling fabricated hits and unearned kills or scores.

Record each accepted N_SHOOT ray in the server-side weapon-shot state and validate the reported origin and destination against the shooter’s and target’s server-tracked bounding cylinders before applying damage. Reject hitsets without a matching, geometrically valid shot.

The validation covers participant geometry and does not add map-occlusion tracing to the dedicated server.