Analyze pronunciation for preview/onboarding users (anonymous users). Saves attempts to database for anonymous users. No authentication required but user_id should be provided.

🔒 Deliberately unauthenticated (onboarding happens before an account exists), but the user_id used to attribute a saved attempt had no ownership check at all: anyone — including an authenticated caller — could pass a REAL registered user's UUID and write a forged pronunciation attempt (score, analysis) into their history/leaderboard placement. When the CALLER does present a valid token, the attempt is attributed to that token's identity, not the client-supplied user_id — closing the "logged in attacker targets a real victim account" case while leaving the genuinely anonymous onboarding flow (no token at all) unchanged.