fix: human vs AI fight bugs — CSP for TTS, invisible sprites, fight end sequence

- Allow huggingface.co in CSP connect-src (fixes Kokoro TTS model download)
- Add registerSW.js route (fixes PWA service worker 404)
- Add _resetPositions() safety after entrance (fixes invisible fighters)
- Fight end sequence works without canvas scene (KO/overlays/log always play)
- Pre-fight instructions in battle log for human players
- NIP-55 visibility sync and cleanup handlers

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

frontend/src/composables/useNostr.ts

@@ -99,6 +99,18 @@ let autoRestoreRan = false
 // Flag: skip relay pic fetch for freshly generated keys (no profile exists)
 let freshlyGenerated = false
 
+// Sync in-memory auth state when tab regains focus (handles external localStorage clearing)
+if (typeof document !== 'undefined') {
+  document.addEventListener('visibilitychange', () => {
+    if (document.visibilityState !== 'visible') return
+    const storedPubkey = loadStored<string>('bf_pubkey')
+    if (!storedPubkey && pubkey.value) {
+      // localStorage was cleared externally — wipe in-memory state to match
+      clearAllState()
+    }
+  })
+}
+
 // Auto-restore session from JWT on first load
 if (!autoRestoreRan && pubkey.value && !bot.value && getToken() && !isTokenExpired()) {
   autoRestoreRan = true