feat: production hardening — background fights, queue tuning, CORS, cycling taglines

- Background fight loop: mock bots auto-fight every ~45s for site activity
  - Quiet hours (2-8 UTC) run 4x slower, jitter prevents robotic timing
  - Configurable via FIGHT_LOOP_ENABLED, FIGHT_LOOP_INTERVAL_MS
- Queue timeout: 30s in prod (was 3s), configurable via QUEUE_TIMEOUT_MS
- CORS: env-configurable via CORS_ORIGIN (default '*')
- Homepage: 40 cycling taglines with typewriter effect
- docker-compose: document all new env vars

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/app.ts

@@ -21,7 +21,9 @@ app.onError((err, c) => {
 })
 
 app.use('*', logger())
-app.use('/api/*', cors({ origin: '*' }))
+// CORS: lock down in production, allow all in dev
+const allowedOrigin = process.env.CORS_ORIGIN || '*'
+app.use('/api/*', cors({ origin: allowedOrigin }))
 
 // Rate limit all POST endpoints (60/min per IP)
 app.use('/api/*', rateLimit(60_000, 60))