[okapitula]

Stacked on #336. Review that PR first; this one retargets to dev once it merges.

Summary

Adds GET /backoffice/sportsbook/players/{userId}/restriction, which returns a player's current sportsbook restriction. It sits under the sportsbook:view grant and returns an unrestricted state when no restriction is in place.

Why

Admins could restrict a player or lift a restriction, but nothing showed the current state. A back office had to change the restriction before it could show whether the player was blocked. The new read uses the same SportsbookRestriction shape the restrict and lift routes return. Staff who can view the sportsbook can see the state, and changing it still needs sportsbook:suspend. An unknown user id returns 404, the same as the write routes.

Alternatives considered

• Adding the restriction to a wider player read. That would tie a sportsbook-only state to another module's surface. A route next to the restrict and lift routes keeps the resource in one place.
• Requiring sportsbook:suspend for the read. Support and review staff need to see why a player can't bet without being able to change it, so the read uses the view grant.

Risks

None. This adds a read-only route and changes no existing contract, table or migration. The player-existence check moved into a shared helper and now uses the strict identity lookup, so a database error during the check returns 500 instead of a false 404.

[klaudia-blazyczek-blurify]

LGTM. I'm giving approve, but it would be good if other dev also reviews this PR