feat: v2 — queue matchmaking, procedural audio, sprite archetypes, auth

- Add queue-based matchmaking with Elo-proximity and 10s timeout
- Procedural sound engine (SFX, voice announcer, 4-track music)
- Sprite system refactored into 6 archetypes (standard, lobster, sheep, cyborg, blob, tank)
- 42+ fight choreographies with themed/generic/wild card selection
- 4 KO finish styles, super-speed mode, hyperdetail close-ups
- Auth routes, JoinBout page, bot profile with stats
- 7-tier ranking system (Baby through Legend)
- Arena and challenge system expansions

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/routes/auth.ts

@@ -0,0 +1,136 @@
+import { Hono } from 'hono'
+import { nanoid } from 'nanoid'
+import { createHash, randomBytes } from 'crypto'
+import { db, schema } from '../db/index.js'
+import { eq } from 'drizzle-orm'
+
+export const authRouter = new Hono()
+
+// Login with Nostr pubkey — returns bot if one exists
+authRouter.post('/login', async (c) => {
+  const body = await c.req.json()
+  const { pubkey } = body
+
+  if (!pubkey || typeof pubkey !== 'string' || pubkey.length !== 64) {
+    return c.json({ error: 'Invalid pubkey.' }, 400)
+  }
+
+  const rows = await db.select({
+    id: schema.bots.id,
+    name: schema.bots.name,
+    avatarSeed: schema.bots.avatarSeed,
+    archetype: schema.bots.archetype,
+    profilePicUrl: schema.bots.profilePicUrl,
+    eloRating: schema.bots.eloRating,
+    wins: schema.bots.wins,
+    losses: schema.bots.losses,
+    winStreak: schema.bots.winStreak,
+    bestStreak: schema.bots.bestStreak,
+    tier: schema.bots.tier,
+  }).from(schema.bots).where(eq(schema.bots.publicKey, pubkey)).limit(1)
+
+  if (rows.length === 0) {
+    return c.json({ exists: false, pubkey })
+  }
+
+  return c.json({ exists: true, bot: rows[0] })
+})
+
+// Register a new bot with Nostr pubkey
+authRouter.post('/register', async (c) => {
+  const body = await c.req.json()
+  const { pubkey, name, webhookUrl, archetype, profilePicUrl } = body
+
+  if (!pubkey || typeof pubkey !== 'string' || pubkey.length !== 64) {
+    return c.json({ error: 'Invalid pubkey.' }, 400)
+  }
+
+  if (!name || typeof name !== 'string' || name.length < 2 || name.length > 32) {
+    return c.json({ error: 'Name must be 2-32 characters.' }, 400)
+  }
+
+  if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
+    return c.json({ error: 'Name must be alphanumeric, hyphens, or underscores.' }, 400)
+  }
+
+  if (!webhookUrl || typeof webhookUrl !== 'string') {
+    return c.json({ error: 'webhookUrl is required.' }, 400)
+  }
+
+  try {
+    new URL(webhookUrl)
+  } catch {
+    return c.json({ error: 'webhookUrl must be a valid URL.' }, 400)
+  }
+
+  // Check pubkey not already used
+  const existingPk = await db.select({ id: schema.bots.id })
+    .from(schema.bots)
+    .where(eq(schema.bots.publicKey, pubkey))
+    .limit(1)
+
+  if (existingPk.length > 0) {
+    return c.json({ error: 'This Nostr key already has a bot.' }, 409)
+  }
+
+  // Check name not taken
+  const existingName = await db.select({ id: schema.bots.id })
+    .from(schema.bots)
+    .where(eq(schema.bots.name, name))
+    .limit(1)
+
+  if (existingName.length > 0) {
+    return c.json({ error: 'A bot with that name already exists.' }, 409)
+  }
+
+  const id = nanoid(12)
+  const secret = randomBytes(32).toString('hex')
+
+  await db.insert(schema.bots).values({
+    id,
+    name,
+    webhookUrl: webhookUrl,
+    avatarSeed: name,
+    archetype: archetype || 'standard',
+    secretHash: createHash('sha256').update(secret).digest('hex'),
+    publicKey: pubkey,
+    profilePicUrl: profilePicUrl || null,
+    createdAt: new Date().toISOString(),
+  })
+
+  return c.json({
+    id,
+    name,
+    archetype: archetype || 'standard',
+    message: 'Bot registered.',
+  }, 201)
+})
+
+// Update bot webhook (requires pubkey match)
+authRouter.post('/update', async (c) => {
+  const body = await c.req.json()
+  const { pubkey, webhookUrl, profilePicUrl } = body
+
+  if (!pubkey || typeof pubkey !== 'string') {
+    return c.json({ error: 'Invalid pubkey.' }, 400)
+  }
+
+  const rows = await db.select({ id: schema.bots.id })
+    .from(schema.bots)
+    .where(eq(schema.bots.publicKey, pubkey))
+    .limit(1)
+
+  if (rows.length === 0) {
+    return c.json({ error: 'No bot found for this key.' }, 404)
+  }
+
+  const updates: Record<string, string> = {}
+  if (webhookUrl) updates.webhookUrl = webhookUrl
+  if (profilePicUrl) updates.profilePicUrl = profilePicUrl
+
+  if (Object.keys(updates).length > 0) {
+    await db.update(schema.bots).set(updates).where(eq(schema.bots.id, rows[0].id))
+  }
+
+  return c.json({ updated: true })
+})