feat(09-01): arena-proxy middleware — REST forwarding to canonical arena

Hono middleware that forwards /api/* to ARENA_UPSTREAM_URL when set, with
standalone mode (env unset) and /api/health untouched. Verified end-to-end
against a real second HTTP server: register a bot upstream, read it back
through the proxy, method/query/JSON body forwarded unchanged, inbound Host
header dropped, response content-encoding/content-length stripped.

TDD: 6 tests written first and confirmed failing (module didn't exist),
then implemented to green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/src/app.ts

@@ -16,6 +16,7 @@ import { adminRouter } from './routes/admin.js'
 import { statsRouter } from './routes/stats.js'
 import { arcadeRouter } from './routes/arcade.js'
 import { rateLimit } from './middleware/rate-limit.js'
+import { arenaProxy } from './middleware/arena-proxy.js'
 
 import { existsSync, readFileSync } from 'fs'
 import { join, dirname } from 'path'
@@ -92,6 +93,10 @@ app.use('/api/docs/*', async (c, next) => {
   if (c.req.method === 'GET') c.header('Cache-Control', 'public, max-age=3600')
 })
 
+// When ARENA_UPSTREAM_URL is set, forward every /api/* request to the
+// canonical arena instead of the local routers (BOT-03). No-ops otherwise.
+app.use('/api/*', arenaProxy)
+
 app.get('/api/health', (c) => c.json({ status: 'ok', name: 'botfights' }))
 
 app.route('/api/auth', authRouter)