fix: human vs AI fight bugs — CSP for TTS, invisible sprites, fight end sequence

- Allow huggingface.co in CSP connect-src (fixes Kokoro TTS model download)
- Add registerSW.js route (fixes PWA service worker 404)
- Add _resetPositions() safety after entrance (fixes invisible fighters)
- Fight end sequence works without canvas scene (KO/overlays/log always play)
- Pre-fight instructions in battle log for human players
- NIP-55 visibility sync and cleanup handlers

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/app.ts

@@ -57,7 +57,7 @@ app.use('*', secureHeaders({
     scriptSrc: ["'self'", 'blob:'],
     styleSrc: ["'self'", "'unsafe-inline'", 'https://fonts.googleapis.com'],
     imgSrc: ["'self'", 'data:', 'blob:'],
-    connectSrc: ["'self'"],
+    connectSrc: ["'self'", 'https://huggingface.co', 'https://*.huggingface.co'],
     fontSrc: ["'self'", 'https://fonts.gstatic.com'],
     workerSrc: ["'self'", 'blob:'],
   } : undefined,
@@ -154,6 +154,7 @@ if (process.env.NODE_ENV === 'production' && existsSync(publicDir)) {
 
   // PWA service worker + related root files
   app.get('/sw.js', (c) => serveFile(c, '/sw.js', 'no-cache'))
+  app.get('/registerSW.js', (c) => serveFile(c, '/registerSW.js', 'no-cache'))
   app.get('/workbox-*.js', (c) => serveFile(c, c.req.path, 'public, max-age=31536000, immutable'))
   app.get('/icon-*.png', (c) => serveFile(c, c.req.path, 'public, max-age=86400'))
   app.get('/icon.svg', (c) => serveFile(c, '/icon.svg', 'public, max-age=86400'))