IDOR: any world owner/deployer can read & modify other players' player-storage

## Summary
The player-storage handlers take `:player_address` from the path but never check it against the authenticated caller. `authorization-middleware.ts:95` only verifies world-level permission (`hasWorldPermission(worldName, signerAddress, parcel)`), and `list-player-storage.ts:34` (and the get/upsert/delete/clear handlers) use `params.player_address` directly without requiring `ctx.verification.auth === player_address`.

## Impact
A world owner/deployer (or any address in `AUTHORIZED_ADDRESSES`) can read, overwrite, and delete the player-storage values of **any** player in that world — `GET/PUT/DELETE /players/:player_address/values[/:key]` and `DELETE /players/:player_address/values`.

## Fix
If player storage is meant to be private per player, require `ctx.verification.auth === params.player_address` (case-insensitive) in the player-storage handlers, in addition to the world-permission check. If world owners are intended to manage player data, document that explicitly. Please confirm the intended access model.