feat: add leaderboard cache, performance benchmarks, and verify SSE cleanup

- Add 30s TTL leaderboard cache with invalidation on fight completion
- Add scoreRound performance benchmark: 1000 rounds in <100ms
- Add checkAnswer performance benchmark: 1000 checks in <50ms
- Add adversarial regex backtracking test for checkAnswer
- Verify SSE cleanup: connections, IP counters, spectator counts, event listeners
  all properly decremented in finally block on disconnect

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/engine/answers.test.ts

@@ -145,3 +145,33 @@ describe('checkAnswer', () => {
     expect(checkAnswer('\t\n  \r', ['Paris'])).toBe(0)
   })
 })
+
+describe('checkAnswer performance', () => {
+  it('completes 1000 checks in under 50ms (<0.05ms each)', () => {
+    const answers = ['Paris', 'London', 'Tokyo']
+    const start = performance.now()
+    for (let i = 0; i < 1000; i++) {
+      checkAnswer('I think the answer is probably Paris', answers)
+    }
+    const elapsed = performance.now() - start
+    expect(elapsed).toBeLessThan(50)
+  })
+
+  it('no regex backtracking on adversarial input', () => {
+    // ReDoS-style strings that could cause catastrophic backtracking
+    const adversarial = [
+      'a'.repeat(10000),
+      'a'.repeat(5000) + '!' + 'a'.repeat(5000),
+      'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaab',
+      '(((((((((((((((((((((((((((((((',
+      'x'.repeat(2000) + 'y'.repeat(2000),
+    ]
+    const start = performance.now()
+    for (const input of adversarial) {
+      checkAnswer(input, ['correct answer', '42', 'true'])
+    }
+    const elapsed = performance.now() - start
+    // Must complete in <100ms total for all adversarial inputs
+    expect(elapsed).toBeLessThan(100)
+  })
+})