Players can vote on cards game time/before/after completed rounds/finished game

**Describe the bug**
Players can vote on any dealt_card by guessing/submitting its ID ***(from the console)** — even before the game starts, or after it ends. Backend `toggle_vote` handler lacks validation and even in completed rounds just from card id. Player can manipulate the data by voting or unvoting the cards after the game ends, if player partner with another player they can share their car ids and manipulate the data later or even before the game starts

**Expected behavior**
Voting must be allowed **only when** the game is active (`started_at` is set **and** `finished_at` is `nil`).

**Desktop (please complete the following information):**
OS: any
Browser: any
Version: any

**Additional context**
Critical missing server-side checks in `handle_event("toggle_vote", …)`:
- No check of game lifecycle (`started_at` / `!finished_at`)

**Are you going to work on fixing this?**

- [x] Yes
- [ ] No