feat: v4 — TUI fight loop, rate limiting, webhook tooling, expanded choreographies

- Fight loop CLI with TUI renderer (ink-style terminal UI)
- Rate limiting middleware for API routes
- Queue cooldowns wired into orchestrator after fights
- Webhook test utility for bot debugging
- API docs route
- Expanded FightScene choreographies and weapon props
- Fix Drizzle transaction execution in orchestrator
- Schema additions, scoring/challenge/mock expansions

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/app.ts

@@ -5,6 +5,9 @@ import { botsRouter } from './routes/bots.js'
 import { fightsRouter } from './routes/fights.js'
 import { queueRouter } from './routes/queue.js'
 import { authRouter } from './routes/auth.js'
+import { docsRouter } from './routes/docs.js'
+import { rateLimit } from './middleware/rate-limit.js'
+import { cleanupOrphanedFights } from './engine/orchestrator.js'
 
 export const app = new Hono()
 
@@ -16,9 +19,20 @@ app.onError((err, c) => {
 app.use('*', logger())
 app.use('/api/*', cors({ origin: '*' }))
 
+// Rate limit all POST endpoints (60/min per IP)
+app.use('/api/*', rateLimit(60_000, 60))
+
 app.get('/api/health', (c) => c.json({ status: 'ok', name: 'botfights' }))
 
 app.route('/api/auth', authRouter)
 app.route('/api/bots', botsRouter)
 app.route('/api/fights', fightsRouter)
 app.route('/api/queue', queueRouter)
+app.route('/api/docs', docsRouter)
+
+// Cleanup orphaned fights on startup
+cleanupOrphanedFights().then(() => {
+  console.log('[botfights] orphaned fights cleaned up')
+}).catch(err => {
+  console.error('[botfights] cleanup error:', err)
+})